a517ff3b099cf20a394fd6c4acfcba39d11b21b42ae341567f372ce9c0191007

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
22-12-2024 06:11

Target

JaffaCakes118_a517ff3b099cf20a394fd6c4acfcba39d11b21b42ae341567f372ce9c0191007.dll
Size

40KB
MD5

b3d36d8bba5f60e3a1ae9bce054727e9
SHA1

9aecbdf51affbdfc972647874878507f871724da
SHA256

a517ff3b099cf20a394fd6c4acfcba39d11b21b42ae341567f372ce9c0191007
SHA512

8f34c5e4da48b97518cf35c658a611d402fc525cc4c1e9d366a8a8aca10504c1b99798eac93b3b8791b2351c8c0fdcae70c6c5422a20b6ec357e1768190b421e
SSDEEP

384:LnOKO6Y7MzPA8+5aAk617tBmgEqTvSYuGS3:SKVPzY3MjKt1TeH

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2584 wrote to memory of 2412	2584	rundll32.exe	30
PID 2584 wrote to memory of 2412	2584	rundll32.exe	30
PID 2584 wrote to memory of 2412	2584	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_a517ff3b099cf20a394fd6c4acfcba39d11b21b42ae341567f372ce9c0191007.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2584
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2584 -s 52
  2⤵
  PID:2412