b0de897f2dce5ba699b5ee67fc22204b485aedd97db3f90df2a45b0c392d3e02

Analysis

max time kernel
94s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
19-04-2024 00:19

Target

f913c3a15a1301296d12c7f2066fc5a9_JaffaCakes118.dll
Size

52KB
MD5

f913c3a15a1301296d12c7f2066fc5a9
SHA1

e5cfedcc45656a5b5827d747c40cb040c4bb751e
SHA256

b0de897f2dce5ba699b5ee67fc22204b485aedd97db3f90df2a45b0c392d3e02
SHA512

96a60d610c7340e78af490c5d3af4850761778fb927a39ddd1d254a3660e98bcb9b6dcc542b85dad43b35c2ca3bc6a3c84f36ba0f14be7573354f612e0c128c7
SSDEEP

1536:9tJMFP4iGROKOgnKpHDJv3tDDZTgocj3:nWuiGMnCqJvtGoe

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4592	4516	WerFault.exe	86

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 732 wrote to memory of 4516	732	rundll32.exe	86
PID 732 wrote to memory of 4516	732	rundll32.exe	86
PID 732 wrote to memory of 4516	732	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f913c3a15a1301296d12c7f2066fc5a9_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:732
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f913c3a15a1301296d12c7f2066fc5a9_JaffaCakes118.dll,#1
  2⤵
  PID:4516
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4516 -s 608
    3⤵
    - Program crash
    PID:4592

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4516 -ip 4516
1⤵
PID:4828

memory/4516-2-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download
memory/4516-3-0x00000000007C0000-0x0000000000896000-memory.dmp

Filesize
856KB

Download