2cb32e82c6003ddf12dc76de6fece275b620a2cb059f3b8a177ff48fdace8aa8

Analysis

max time kernel
10s
max time network
16s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
19/07/2024, 00:21

Target

59b5e9480298821332ff1b690aebc5fe_JaffaCakes118.dll
Size

128KB
MD5

59b5e9480298821332ff1b690aebc5fe
SHA1

a3fd8ff3b4e5fc10f0e50aee714803999f06ca31
SHA256

2cb32e82c6003ddf12dc76de6fece275b620a2cb059f3b8a177ff48fdace8aa8
SHA512

312681bfcff614220ba5424a7f7f0364f7989da323c695c0633e77ad188cb308f94ec3a8834d09bb8fc20cf54973d9f66c2e52173d931a525077029f3428abd3
SSDEEP

3072:NSeOLNOWbn2wi7c/4zGP7Vmdi8Tvoxp6+:NSLLhawYi4zfdHTvuL

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
916	2568	WerFault.exe	29

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2120 wrote to memory of 2568	2120	rundll32.exe	29
PID 2120 wrote to memory of 2568	2120	rundll32.exe	29
PID 2120 wrote to memory of 2568	2120	rundll32.exe	29
PID 2120 wrote to memory of 2568	2120	rundll32.exe	29
PID 2120 wrote to memory of 2568	2120	rundll32.exe	29
PID 2120 wrote to memory of 2568	2120	rundll32.exe	29
PID 2120 wrote to memory of 2568	2120	rundll32.exe	29
PID 2568 wrote to memory of 916	2568	rundll32.exe	30
PID 2568 wrote to memory of 916	2568	rundll32.exe	30
PID 2568 wrote to memory of 916	2568	rundll32.exe	30
PID 2568 wrote to memory of 916	2568	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\59b5e9480298821332ff1b690aebc5fe_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2120
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\59b5e9480298821332ff1b690aebc5fe_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2568
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2568 -s 252
    3⤵
    - Program crash
    PID:916