24fc6e7c22402cb67de02d3cffb6f9659db3a7c25e74c87c90f87dfaa6d140e0

Analysis

max time kernel
145s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
11-04-2024 19:08

Target

ee233e16958768992086207345e84556_JaffaCakes118.dll
Size

127KB
MD5

ee233e16958768992086207345e84556
SHA1

7647ac35b342f27ee51407ed63fa680b20b8fafb
SHA256

24fc6e7c22402cb67de02d3cffb6f9659db3a7c25e74c87c90f87dfaa6d140e0
SHA512

a530d2533ae761a183404130372c4b06514c06224f491cdc5c32694c355413531d29ccc56e2ca6d4b47442fb4ffb5457d5ce53ee89a2a6f4e2a9d5c0a4252de3
SSDEEP

1536:h+sRWd4nhueU5u2s1N/47TVWeBeu644kPOLD38lKHPEryZ21uZjYCBA3MpM7c8uW:5sURE3VW8POLwlKb21uRYCuLMF6eFk

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2560 3464 WerFault.exe rundll32.exe

pid	pid_target	process	target process
2560	3464	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 872 wrote to memory of 3464	872	rundll32.exe	rundll32.exe
PID 872 wrote to memory of 3464	872	rundll32.exe	rundll32.exe
PID 872 wrote to memory of 3464	872	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ee233e16958768992086207345e84556_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:872
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ee233e16958768992086207345e84556_JaffaCakes118.dll,#1
  2⤵
  PID:3464
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3464 -s 608
    3⤵
    - Program crash
    PID:2560

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3464 -ip 3464
1⤵
PID:2616