ee40c926c7ba0be2ea966ab84311194c1998f56e81c86e8e718409025629be9b

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
19/07/2024, 16:58

Target

5cd6b87952d0114bb2f736356f1284c4_JaffaCakes118.dll
Size

221KB
MD5

5cd6b87952d0114bb2f736356f1284c4
SHA1

fc2771fc34e82141ad15f0366725fd0d183e1bd3
SHA256

ee40c926c7ba0be2ea966ab84311194c1998f56e81c86e8e718409025629be9b
SHA512

b0b31dbe8c2826e06087435c26603c6ddabd54659715d42c3fc181d9dcb1d314ef07dd9a11aa35d432479f62c5181e8f6755fddc16229e07955c03c94f5ef311
SSDEEP

6144:A8JixMxALviUCNG80WNUWppM+PPNeRHpL:Auix9SEl8NeRHp

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2064	2224	WerFault.exe	31

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2308 wrote to memory of 2224	2308	rundll32.exe	31
PID 2308 wrote to memory of 2224	2308	rundll32.exe	31
PID 2308 wrote to memory of 2224	2308	rundll32.exe	31
PID 2308 wrote to memory of 2224	2308	rundll32.exe	31
PID 2308 wrote to memory of 2224	2308	rundll32.exe	31
PID 2308 wrote to memory of 2224	2308	rundll32.exe	31
PID 2308 wrote to memory of 2224	2308	rundll32.exe	31
PID 2224 wrote to memory of 2064	2224	rundll32.exe	32
PID 2224 wrote to memory of 2064	2224	rundll32.exe	32
PID 2224 wrote to memory of 2064	2224	rundll32.exe	32
PID 2224 wrote to memory of 2064	2224	rundll32.exe	32

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5cd6b87952d0114bb2f736356f1284c4_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2308
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5cd6b87952d0114bb2f736356f1284c4_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2224
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2224 -s 260
    3⤵
    - Program crash
    PID:2064