2170709ed4956e7edf5c070ee11927b1adb2dc34703208230c2eb0e7b4480c38

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
21/07/2024, 20:55

Target

615d6c503d7669d31bdb51baff264f0f_JaffaCakes118.dll
Size

92KB
MD5

615d6c503d7669d31bdb51baff264f0f
SHA1

9c8a4c3725b0b83653d251c04ea0102d1de4adf4
SHA256

2170709ed4956e7edf5c070ee11927b1adb2dc34703208230c2eb0e7b4480c38
SHA512

34d0f87e834fb57debb5262f6ef475cceb1c923d85d058c281d96ad5dfd04a98774701912318f45957469b700fdc0ae0f90ef1ecc01c1628170e8eb8a1d1d864
SSDEEP

1536:iI12A93EScIR5Av46uTXdoUpIV0YxowlyZyOL:l12AtEScIp65XVHxoL8

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2444	2308	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2292 wrote to memory of 2308	2292	rundll32.exe	28
PID 2292 wrote to memory of 2308	2292	rundll32.exe	28
PID 2292 wrote to memory of 2308	2292	rundll32.exe	28
PID 2292 wrote to memory of 2308	2292	rundll32.exe	28
PID 2292 wrote to memory of 2308	2292	rundll32.exe	28
PID 2292 wrote to memory of 2308	2292	rundll32.exe	28
PID 2292 wrote to memory of 2308	2292	rundll32.exe	28
PID 2308 wrote to memory of 2444	2308	rundll32.exe	29
PID 2308 wrote to memory of 2444	2308	rundll32.exe	29
PID 2308 wrote to memory of 2444	2308	rundll32.exe	29
PID 2308 wrote to memory of 2444	2308	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\615d6c503d7669d31bdb51baff264f0f_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2292
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\615d6c503d7669d31bdb51baff264f0f_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2308
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2308 -s 224
    3⤵
    - Program crash
    PID:2444