d99cf11dec8c0e8204775ccc9090408ae10eacfd4ddbcbd32605b5580cf4f5a6

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
19/04/2024, 02:24

Target

f94c2fd16ba335b79576dbed77fd1a8e_JaffaCakes118.dll
Size

30KB
MD5

f94c2fd16ba335b79576dbed77fd1a8e
SHA1

482d99420581eee34c943c3be1ba734f5465c0b5
SHA256

d99cf11dec8c0e8204775ccc9090408ae10eacfd4ddbcbd32605b5580cf4f5a6
SHA512

be9c0ad64a5dfd3a3c6d7b833720a50968bc74af2db85cd2d17ebfaac8e54cdb6e1f47daaaa2b3b1cc908ed65dcf0bc1acd4ff07530f935935a9c32115ec914b
SSDEEP

384:DhiMKS5sT1Wzjm2ivSyaZYI1bI6fDpBsp1MVP7BoMiDpR2KA89nLdnXfUp0NaYM2:DuS5sBKy2ArARJJ7l2MibHvdvULYMfe

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
828	1928	WerFault.exe	88

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5028 wrote to memory of 1928	5028	rundll32.exe	88
PID 5028 wrote to memory of 1928	5028	rundll32.exe	88
PID 5028 wrote to memory of 1928	5028	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f94c2fd16ba335b79576dbed77fd1a8e_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5028
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f94c2fd16ba335b79576dbed77fd1a8e_JaffaCakes118.dll,#1
  2⤵
  PID:1928
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1928 -s 544
    3⤵
    - Program crash
    PID:828

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1928 -ip 1928
1⤵
PID:2396