13f7c8d44d4c7f1a44d1bfe37d085dde4c0089036f3f01c477d3e086d677105a

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
08/04/2024, 21:07

Target

e86b55b1af50e953464048dfe94c6789_JaffaCakes118.dll
Size

745KB
MD5

e86b55b1af50e953464048dfe94c6789
SHA1

2ba4b4cf40de5cdb32931e2f11b0222b2bc1754a
SHA256

13f7c8d44d4c7f1a44d1bfe37d085dde4c0089036f3f01c477d3e086d677105a
SHA512

10c5349ecc04e5edcffe6994877768c54f0e059b0217576fa266880ea4cfc6e278dba23e2218e70f5233bdffbf932cc12a5c8a218cd549d7b4ab9f7a15e6b6cf
SSDEEP

12288:Fm77gQ4mKTzOZyewpvXYW1M2NpxcuS7Jab5nX9EU9WTCdP2mjAuz:FmwQ45A17Ub5nNEaFdNJz

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3708	2532	WerFault.exe	85

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2156 wrote to memory of 2532	2156	rundll32.exe	85
PID 2156 wrote to memory of 2532	2156	rundll32.exe	85
PID 2156 wrote to memory of 2532	2156	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e86b55b1af50e953464048dfe94c6789_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2156
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\e86b55b1af50e953464048dfe94c6789_JaffaCakes118.dll,#1
  2⤵
  PID:2532
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2532 -s 708
    3⤵
    - Program crash
    PID:3708

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 2532 -ip 2532
1⤵
PID:2548