88cf2025a96bc5a45f86e8e464605d3ea352446a9fb8b2fbf327f6b1e20953c3

Analysis

max time kernel
146s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
18/04/2024, 23:46

Target

f904bf6e152f648c3151029395c6f50d_JaffaCakes118.dll
Size

28KB
MD5

f904bf6e152f648c3151029395c6f50d
SHA1

32293fed38f66f41d32875eb896f2c3ec2d4a27d
SHA256

88cf2025a96bc5a45f86e8e464605d3ea352446a9fb8b2fbf327f6b1e20953c3
SHA512

9260f25d4ed0f8ab4fba1a3e5c3b454e5867fa9bcbd74621a463c505705a860caa8ea33a0429b6a3471c24563b091e5bce5bd233915f6fe8650cdc1e46b3649a
SSDEEP

768:FnPSh/S9+ihCo9jtYB8Bhh6ax6htCmqqOQSnn8MyvGqa0XZcYMx:FKgY29Bhh6GtmqqbW9ERacZ0x

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2164	1516	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2424 wrote to memory of 1516	2424	rundll32.exe	82
PID 2424 wrote to memory of 1516	2424	rundll32.exe	82
PID 2424 wrote to memory of 1516	2424	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f904bf6e152f648c3151029395c6f50d_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2424
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f904bf6e152f648c3151029395c6f50d_JaffaCakes118.dll,#1
  2⤵
  PID:1516
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1516 -s 552
    3⤵
    - Program crash
    PID:2164

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 1516 -ip 1516
1⤵
PID:1140

memory/1516-0-0x0000000010000000-0x0000000010015000-memory.dmp

Filesize
84KB

Download