e13bd6f75d9866a9cdad5fd689113639151a12aac9276687d4cbc220183716a6

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
28/08/2024, 23:25

Target

c7d66d592929ed4b21ee6d5b8d9ce70b_JaffaCakes118.dll
Size

339KB
MD5

c7d66d592929ed4b21ee6d5b8d9ce70b
SHA1

2ac1f1cf402d7af4d566f29c80dd8d514a32bc09
SHA256

e13bd6f75d9866a9cdad5fd689113639151a12aac9276687d4cbc220183716a6
SHA512

e0c5a46a80ce78f742f6547d494b9286de9c86a83a01e29f0e342bfd54ce9df09f20d7dfd91f833a02712cb0572d8f6762e7b8976f591c08b6acff4470ab65bb
SSDEEP

6144:brrJevdhxIg9hEJsbx7qNFOXeQ/QtBvjmxTGo8JpIFoh2Zv0M7XPJu8RZMe:HAIs1qNFORiltq

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2396 wrote to memory of 2416	2396	rundll32.exe	30
PID 2396 wrote to memory of 2416	2396	rundll32.exe	30
PID 2396 wrote to memory of 2416	2396	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c7d66d592929ed4b21ee6d5b8d9ce70b_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2396
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2396 -s 80
  2⤵
  PID:2416