b6615f92504c9bf3c88f2728f118b46043c2177d330dbdcf07d9707810da75c1

Analysis

max time kernel
12s
max time network
19s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
15/07/2024, 07:23

Target

48ca5ed55c56944a44fa8891175d0ede_JaffaCakes118.dll
Size

8.0MB
MD5

48ca5ed55c56944a44fa8891175d0ede
SHA1

49830440e6a920c4bdfe368f49539c6e24c69cf6
SHA256

b6615f92504c9bf3c88f2728f118b46043c2177d330dbdcf07d9707810da75c1
SHA512

f71a4bb67b678c3a8e95b42f898829d62cd93f57cdfcdaaf18e0dab276b19fe727a4ba3473555ea2a100e416b138952583083d808a415c598ebc28128f6362e3
SSDEEP

98304:vFFhmgb+SgJFFhmgb+SgdFFhmgb+SgAFFhmgb+Sg:tFhmgb+rFhmgb+XFhmgb+6Fhmgb+

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1420	1656	WerFault.exe	29

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1144 wrote to memory of 1656	1144	rundll32.exe	29
PID 1144 wrote to memory of 1656	1144	rundll32.exe	29
PID 1144 wrote to memory of 1656	1144	rundll32.exe	29
PID 1144 wrote to memory of 1656	1144	rundll32.exe	29
PID 1144 wrote to memory of 1656	1144	rundll32.exe	29
PID 1144 wrote to memory of 1656	1144	rundll32.exe	29
PID 1144 wrote to memory of 1656	1144	rundll32.exe	29
PID 1656 wrote to memory of 1420	1656	rundll32.exe	30
PID 1656 wrote to memory of 1420	1656	rundll32.exe	30
PID 1656 wrote to memory of 1420	1656	rundll32.exe	30
PID 1656 wrote to memory of 1420	1656	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\48ca5ed55c56944a44fa8891175d0ede_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1144
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\48ca5ed55c56944a44fa8891175d0ede_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1656
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1656 -s 224
    3⤵
    - Program crash
    PID:1420