a5de4c6200e29d611c345745253dcefa6b76719a4c8cb1f2eb3b14b39f58f10d

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
15/07/2024, 10:37

Target

496b9216f99b05e246e53a3f2a47760c_JaffaCakes118.dll
Size

204KB
MD5

496b9216f99b05e246e53a3f2a47760c
SHA1

bafe7782ed4f98efc1a3ce173a21501d676a9e90
SHA256

a5de4c6200e29d611c345745253dcefa6b76719a4c8cb1f2eb3b14b39f58f10d
SHA512

10b1e2207584d16e9c54fa5182725954bec7afae0e95b0798b58c7a7de84e34c4b34b80843f07c4650826bccb326a0e3daa66537c831d145a66838ec883016f9
SSDEEP

3072:WP3E4hr7WWCZ9dyDIznT2b4XFZJ00bmbJQ6WXslSMcFRIPm30qHvcO5VH2Xhx+FW:WyJlFXKQZuhx+K7

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2756	2712	WerFault.exe	30

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2272 wrote to memory of 2712	2272	rundll32.exe	30
PID 2272 wrote to memory of 2712	2272	rundll32.exe	30
PID 2272 wrote to memory of 2712	2272	rundll32.exe	30
PID 2272 wrote to memory of 2712	2272	rundll32.exe	30
PID 2272 wrote to memory of 2712	2272	rundll32.exe	30
PID 2272 wrote to memory of 2712	2272	rundll32.exe	30
PID 2272 wrote to memory of 2712	2272	rundll32.exe	30
PID 2712 wrote to memory of 2756	2712	rundll32.exe	31
PID 2712 wrote to memory of 2756	2712	rundll32.exe	31
PID 2712 wrote to memory of 2756	2712	rundll32.exe	31
PID 2712 wrote to memory of 2756	2712	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\496b9216f99b05e246e53a3f2a47760c_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2272
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\496b9216f99b05e246e53a3f2a47760c_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2712
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2712 -s 260
    3⤵
    - Program crash
    PID:2756