76ed565ca552fd554ab90b719ee6b68310d1e74ad8b0d21cdb785108d217ec5e

Analysis

max time kernel
93s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
11/04/2024, 13:03

Target

ed7c362aa90cf2c5f1cbdd2e2d38b141_JaffaCakes118.dll
Size

392KB
MD5

ed7c362aa90cf2c5f1cbdd2e2d38b141
SHA1

699873b57ad6e3d96d2218b1e89a37f805e04262
SHA256

76ed565ca552fd554ab90b719ee6b68310d1e74ad8b0d21cdb785108d217ec5e
SHA512

0414b982dea0f4a5d454312683b792bb15051a3e69ba06cbda860e1d5452ecdd7bbc948d13c07ff448dd7dddbaafe3fa2718ab178fee943800ad0a5ffafaac83
SSDEEP

6144:mDouUgDfvRrTW5x/lsEvVOPRgSqV8I4QTBJfh1mCk0lf/:ngDfv53qitc8I4QTrZ1J9

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
400	3716	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1100 wrote to memory of 3716	1100	rundll32.exe	84
PID 1100 wrote to memory of 3716	1100	rundll32.exe	84
PID 1100 wrote to memory of 3716	1100	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ed7c362aa90cf2c5f1cbdd2e2d38b141_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1100
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ed7c362aa90cf2c5f1cbdd2e2d38b141_JaffaCakes118.dll,#1
  2⤵
  PID:3716
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3716 -s 620
    3⤵
    - Program crash
    PID:400

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3716 -ip 3716
1⤵
PID:3196

memory/3716-0-0x0000000010000000-0x0000000010062000-memory.dmp

Filesize
392KB

Download