29fac454214d38134a1fc604a7217473c6d0b7b640bc8bd20434e4dfd7bcd89b

Analysis

max time kernel
148s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
18-04-2024 15:05

Target

f8425111990f9e6eb6d110d38b498ec4_JaffaCakes118.dll
Size

80KB
MD5

f8425111990f9e6eb6d110d38b498ec4
SHA1

dc4ac7e5b65cae8e14d2f3a4f956576fa09b3176
SHA256

29fac454214d38134a1fc604a7217473c6d0b7b640bc8bd20434e4dfd7bcd89b
SHA512

58038a20cfb8aa4c9d40d137334bb4313174510b519360abe17c19f35206b74e9a565aea0ba9358908cb83f1fbd45af94db188a040fe5417237c6c2c0121ffa4
SSDEEP

1536:wZuGEXEqGdedNDC4QuJYVC/9B9EMakmUts38bYutFcdj5WZyNe6Lv:wZuGEX51CqYClBvE4s380ycdVWZyN77

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4392	4912	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 700 wrote to memory of 4912	700	rundll32.exe	84
PID 700 wrote to memory of 4912	700	rundll32.exe	84
PID 700 wrote to memory of 4912	700	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f8425111990f9e6eb6d110d38b498ec4_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:700
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f8425111990f9e6eb6d110d38b498ec4_JaffaCakes118.dll,#1
  2⤵
  PID:4912
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4912 -s 608
    3⤵
    - Program crash
    PID:4392

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4912 -ip 4912
1⤵
PID:3168

memory/4912-0-0x0000000010000000-0x0000000010026000-memory.dmp

Filesize
152KB

Download