6541bd5068d88d4e2e337a184e74fdee50358c3ed27e828e91b8efa3280073cd

Analysis

max time kernel
94s
max time network
113s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
18/04/2024, 13:14

Target

f811cdeadb45913782828655d321381c_JaffaCakes118.dll
Size

177KB
MD5

f811cdeadb45913782828655d321381c
SHA1

94b8b05ad1349b505735690a32d9576c05e59522
SHA256

6541bd5068d88d4e2e337a184e74fdee50358c3ed27e828e91b8efa3280073cd
SHA512

fb87169be14c35dd20d0f8cdfd9096867e111e49ea718b878b82b93b3d93678d89f23fb82d9822682966714fc8ae9aaf399af043067f3b11ff468dd0f61658ab
SSDEEP

3072:4uhE6zRkEfal09DStvh4LwDJKATV+cM/cxqi/n5DPyQf7MXph+lcuf:4uh/nD44A+cS0q4JMXph+lz

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2356	844	WerFault.exe	84
5068	844	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2408 wrote to memory of 844	2408	rundll32.exe	84
PID 2408 wrote to memory of 844	2408	rundll32.exe	84
PID 2408 wrote to memory of 844	2408	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f811cdeadb45913782828655d321381c_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2408
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f811cdeadb45913782828655d321381c_JaffaCakes118.dll,#1
  2⤵
  PID:844
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 844 -s 544
    3⤵
    - Program crash
    PID:2356
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 844 -s 800
    3⤵
    - Program crash
    PID:5068

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 844 -ip 844
1⤵
PID:1604

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 844 -ip 844
1⤵
PID:4968