e62ed95ff9a6915957bf388ef4cc0262cd06aa1cc880526fd3df4e310c0fb219

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
22/12/2024, 18:49

Target

JaffaCakes118_e62ed95ff9a6915957bf388ef4cc0262cd06aa1cc880526fd3df4e310c0fb219.dll
Size

36KB
MD5

adf2448e76cbe5033f2f88168b78729d
SHA1

8a2cf3f8ee7576a439b229eaf17a5b145402cda3
SHA256

e62ed95ff9a6915957bf388ef4cc0262cd06aa1cc880526fd3df4e310c0fb219
SHA512

8f686c0da8ed9748fb3d2808a1dbccfd89f0b439f0b8d2f7827af6f87301f6d2a0a5765f84fd26a6d88543275375d414d9180627967a3e463408ae105f1cc3d8
SSDEEP

192:hHVMfa7TTCjJSixzPSAA56RCK7Yu/VPgweXBAQYfPq/3Kbr:h1Mf0gJSix2AA56RCiZV6GQYnq/6b

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2360 wrote to memory of 3044	2360	rundll32.exe	30
PID 2360 wrote to memory of 3044	2360	rundll32.exe	30
PID 2360 wrote to memory of 3044	2360	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_e62ed95ff9a6915957bf388ef4cc0262cd06aa1cc880526fd3df4e310c0fb219.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2360
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2360 -s 52
  2⤵
  PID:3044