19b0cfc57bbe8e349d176de93f4fec2b6368334423413c060c0a7c8f3591f35b

Analysis

max time kernel
122s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
20-09-2024 14:47

Target

edd273e86ba53a797198481865bd143a_JaffaCakes118.dll
Size

255KB
MD5

edd273e86ba53a797198481865bd143a
SHA1

9242fb08037c4432f71ff6cd274d70b1219edacc
SHA256

19b0cfc57bbe8e349d176de93f4fec2b6368334423413c060c0a7c8f3591f35b
SHA512

d1d3e6cf75669cb941c5422a08994674d31667c269abbfd2502ff9daac2b0827ebb57d621ebf0880fac26ae01a920c059bea5d8f0fcfe9ee570f0aacc550b8fe
SSDEEP

3072:mGRTrUD4P5/gm1Hw4CKk3wDBRASJfgjHyfTun8gf7o66d9TdpXDIYJN4RdCvu7Ke:mGRTUm1aAfb1T6xj36rbTI4L

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2336 wrote to memory of 1768	2336	rundll32.exe	30
PID 2336 wrote to memory of 1768	2336	rundll32.exe	30
PID 2336 wrote to memory of 1768	2336	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\edd273e86ba53a797198481865bd143a_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2336
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2336 -s 124
  2⤵
  PID:1768