db8b1745aa1194c9538acd9241d1b998a551186f4724aca572275bdb23ccff54

Analysis

max time kernel
93s
max time network
113s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
16-04-2024 09:45

Target

f3389177378084f781a0c4a9af41e985_JaffaCakes118.dll
Size

68KB
MD5

f3389177378084f781a0c4a9af41e985
SHA1

47e4c45ce812d167875f83e486cfa04112ca60a6
SHA256

db8b1745aa1194c9538acd9241d1b998a551186f4724aca572275bdb23ccff54
SHA512

97de7476cbfc379f1f2129169c21cc8acd2ca6508fe919fbf1a2bd403e210b80156b52d9dbcb250d4254e7652494a2f2f7f47d938ba22814900a1de4be8774c0
SSDEEP

768:fb9lE9x/tHCTn7BWJ2uBTbnCzwiVD39VY3VkoYF9l6JMCAPK9Zp7F:fhyN5+n7BI2uTwhy3VkjF9lR67F

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4572	2644	WerFault.exe	85

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5064 wrote to memory of 2644	5064	rundll32.exe	85
PID 5064 wrote to memory of 2644	5064	rundll32.exe	85
PID 5064 wrote to memory of 2644	5064	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f3389177378084f781a0c4a9af41e985_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5064
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f3389177378084f781a0c4a9af41e985_JaffaCakes118.dll,#1
  2⤵
  PID:2644
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2644 -s 596
    3⤵
    - Program crash
    PID:4572

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2644 -ip 2644
1⤵
PID:4744