a72681756346e338e96b3deb8304f5c4a3a0b83c8ed2d9f1444cb229e0e0453b

Analysis

max time kernel
14s
max time network
18s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
20-07-2024 03:04

Target

5ecad23b3ae7365a25b11d4d608adffd_JaffaCakes118.dll
Size

808KB
MD5

5ecad23b3ae7365a25b11d4d608adffd
SHA1

9e5dd712722e3ca96fce6c092b83e787e3dfa001
SHA256

a72681756346e338e96b3deb8304f5c4a3a0b83c8ed2d9f1444cb229e0e0453b
SHA512

4720b120b00100a5923740a0382e988cfec7bebb9ff8b017963fd9b0abf83dd8e85761172ba65de7bc7d93c5a249d47c507e318220ba1004504e8c11dab9ecb3
SSDEEP

12288:CzOQeyh78IrXbXHQr/fBdYinxl9DuHTUPpBJ:iOQe47BLniJDuHTURBJ

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2256	2160	WerFault.exe	30

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2780 wrote to memory of 2160	2780	rundll32.exe	30
PID 2780 wrote to memory of 2160	2780	rundll32.exe	30
PID 2780 wrote to memory of 2160	2780	rundll32.exe	30
PID 2780 wrote to memory of 2160	2780	rundll32.exe	30
PID 2780 wrote to memory of 2160	2780	rundll32.exe	30
PID 2780 wrote to memory of 2160	2780	rundll32.exe	30
PID 2780 wrote to memory of 2160	2780	rundll32.exe	30
PID 2160 wrote to memory of 2256	2160	rundll32.exe	31
PID 2160 wrote to memory of 2256	2160	rundll32.exe	31
PID 2160 wrote to memory of 2256	2160	rundll32.exe	31
PID 2160 wrote to memory of 2256	2160	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5ecad23b3ae7365a25b11d4d608adffd_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2780
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5ecad23b3ae7365a25b11d4d608adffd_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2160
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2160 -s 272
    3⤵
    - Program crash
    PID:2256