561b732226621fa60e2a5f27f9f89f40e9fe06d1d215f8873b6612a734a0ac4e

Analysis

max time kernel
147s
max time network
161s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
18/04/2024, 18:28

Target

f884ced7aacce437148287c148be4f64_JaffaCakes118.dll
Size

24KB
MD5

f884ced7aacce437148287c148be4f64
SHA1

b69b1f0eb79e9d607758e2c47e9112669bcf7c49
SHA256

561b732226621fa60e2a5f27f9f89f40e9fe06d1d215f8873b6612a734a0ac4e
SHA512

27bb0145172c423fc572773531af30ef925d118dd663eda89778d65a1bb27fbd5023f0d1e7dbd544b3b3b7d021c0f182377c9be53dcf18e9176160d1bc161f79
SSDEEP

192:iHhDfT66xnxDRkbL8rBCBkJEdYi0me3F+LPIsB8Yx:iHh5xDRgL8r8mJEdYi0m7LP98Yx

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2596	2424	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4028 wrote to memory of 2424	4028	rundll32.exe	83
PID 4028 wrote to memory of 2424	4028	rundll32.exe	83
PID 4028 wrote to memory of 2424	4028	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f884ced7aacce437148287c148be4f64_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4028
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f884ced7aacce437148287c148be4f64_JaffaCakes118.dll,#1
  2⤵
  PID:2424
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2424 -s 624
    3⤵
    - Program crash
    PID:2596

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 2424 -ip 2424
1⤵
PID:2848