c98d776e803d93272dc1f718ac94d29212ef326423b921ce9f5d60d400dc3c16

Analysis

max time kernel
136s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
19-04-2024 12:34

Target

fa4e896207d4d6f2c5e552622aaaf75c_JaffaCakes118.dll
Size

34KB
MD5

fa4e896207d4d6f2c5e552622aaaf75c
SHA1

35418287e0d0e388c27d277162eecccb7b6d036f
SHA256

c98d776e803d93272dc1f718ac94d29212ef326423b921ce9f5d60d400dc3c16
SHA512

aff3045cbf4812ab905ce6d5267599212cb251913d9a6584204e2cc26b207464f251d17501f9e6849e0e79138eeca8e7bab7f1e258226f61425b3d59209bd2af
SSDEEP

768:1x4KfVueiokuD3S3hoxwWFiPS03PyBK2s1Jg+9W:1xRXmuD3S3cwEit6g2sgIW

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4676	4932	WerFault.exe	87

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5080 wrote to memory of 4932	5080	rundll32.exe	87
PID 5080 wrote to memory of 4932	5080	rundll32.exe	87
PID 5080 wrote to memory of 4932	5080	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fa4e896207d4d6f2c5e552622aaaf75c_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5080
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\fa4e896207d4d6f2c5e552622aaaf75c_JaffaCakes118.dll,#1
  2⤵
  PID:4932
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4932 -s 548
    3⤵
    - Program crash
    PID:4676

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 4932 -ip 4932
1⤵
PID:3256

memory/4932-0-0x0000000010000000-0x0000000010021000-memory.dmp

Filesize
132KB

Download