142fa14622fbfc9f689a7077a3fe1299d321ff20840cb6ffdd8e859fe52f0701

Analysis

max time kernel
93s
max time network
98s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
29/03/2024, 12:00

Target

2170420bdc794d2e2ce5d6a12777de7b_JaffaCakes118.dll
Size

206KB
MD5

2170420bdc794d2e2ce5d6a12777de7b
SHA1

00833283070c1baa55e2e96af7390ce88c9eb056
SHA256

142fa14622fbfc9f689a7077a3fe1299d321ff20840cb6ffdd8e859fe52f0701
SHA512

f8f44d6a188f42b1f0ebdda0c80ef402a6f074d004284b89ba9d22355b8471b9cea36c765357b7965edbab47068bbb09e26a7f57ab92bbc82d3930b34deeb6e2
SSDEEP

3072:u1okQ8G/JEsmSEsmQ1okQ8G/JEsmSEsmSEsmQ1okQ8G/1:SgHJZLZJgHJZLZLZJgH1

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3916	2200	WerFault.exe	85

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 916 wrote to memory of 2200	916	rundll32.exe	85
PID 916 wrote to memory of 2200	916	rundll32.exe	85
PID 916 wrote to memory of 2200	916	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2170420bdc794d2e2ce5d6a12777de7b_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:916
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2170420bdc794d2e2ce5d6a12777de7b_JaffaCakes118.dll,#1
  2⤵
  PID:2200
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2200 -s 600
    3⤵
    - Program crash
    PID:3916

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 2200 -ip 2200
1⤵
PID:3584