9872bd8eae7859eb42fef38352c42a39629d8b7ca7f3fc4b9beb60ed54c66334

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
14/07/2024, 18:17

Target

46f659f6113248632423c7ea3d76f793_JaffaCakes118.dll
Size

169KB
MD5

46f659f6113248632423c7ea3d76f793
SHA1

3132dcb9067e2a139686e44cf31f1482dcf524a6
SHA256

9872bd8eae7859eb42fef38352c42a39629d8b7ca7f3fc4b9beb60ed54c66334
SHA512

0c9f4ee53e5f5340c2e63ebbd06a36ad28a760ed0ec43a9f01c8ff373cacd5cecf732dc5f2919f2583ab8939de28ce1ac7be3228955ba1850671ac3355e4acb1
SSDEEP

3072:vuhE6zRkoGnKR8++IN25UvVJbSnDTT7Yvjb5y6UNfvyp+4zK5EEsx:vuhpGn8+u25EV1CT0KfvyAji

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2660	2396	WerFault.exe	30

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2184 wrote to memory of 2396	2184	rundll32.exe	30
PID 2184 wrote to memory of 2396	2184	rundll32.exe	30
PID 2184 wrote to memory of 2396	2184	rundll32.exe	30
PID 2184 wrote to memory of 2396	2184	rundll32.exe	30
PID 2184 wrote to memory of 2396	2184	rundll32.exe	30
PID 2184 wrote to memory of 2396	2184	rundll32.exe	30
PID 2184 wrote to memory of 2396	2184	rundll32.exe	30
PID 2396 wrote to memory of 2660	2396	rundll32.exe	31
PID 2396 wrote to memory of 2660	2396	rundll32.exe	31
PID 2396 wrote to memory of 2660	2396	rundll32.exe	31
PID 2396 wrote to memory of 2660	2396	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\46f659f6113248632423c7ea3d76f793_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2184
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\46f659f6113248632423c7ea3d76f793_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2396
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2396 -s 260
    3⤵
    - Program crash
    PID:2660