95a635d445577fc8a905df5d2592ceaba8ccbd49848a5a317388581e51a2936b

Analysis

max time kernel
124s
max time network
132s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
18/04/2024, 18:29

Target

f88502df61f5827bded120acc62aa535_JaffaCakes118.dll
Size

251KB
MD5

f88502df61f5827bded120acc62aa535
SHA1

a98cfc03a06f75cbe34104eb3842bfc7ce4c601d
SHA256

95a635d445577fc8a905df5d2592ceaba8ccbd49848a5a317388581e51a2936b
SHA512

ded59d4d3823ce925018b925c37d554f7047f8afb66e344e2e3b07d877a1cc748cf99a7a1389415b5f50462691a581596992e9a5b2e93c7d642a595e632e9c3c
SSDEEP

3072:Huzi84ekVJyAVG8glW8dhtXFDlaetAqKBpJixzYfK4DPeq411J4oIX1cd3XVildR:HuR3GY8gwyJ9t5byf7oIXuhHUGeu

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1524	2000	WerFault.exe	89

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 464 wrote to memory of 2000	464	rundll32.exe	89
PID 464 wrote to memory of 2000	464	rundll32.exe	89
PID 464 wrote to memory of 2000	464	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f88502df61f5827bded120acc62aa535_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:464
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f88502df61f5827bded120acc62aa535_JaffaCakes118.dll,#1
  2⤵
  PID:2000
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2000 -s 580
    3⤵
    - Program crash
    PID:1524

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2000 -ip 2000
1⤵
PID:3068

memory/2000-0-0x0000000000AE0000-0x0000000000B1F000-memory.dmp

Filesize
252KB

Download
memory/2000-1-0x0000000010000000-0x0000000010043000-memory.dmp

Filesize
268KB

Download