93b724536b967684749bea31324efe53ad6c82af3a364e40b14850c6eb85f954

Analysis

max time kernel
139s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
19/04/2024, 14:49

Target

fa892d6eed0066286bb93df739ac9a3e_JaffaCakes118.dll
Size

18KB
MD5

fa892d6eed0066286bb93df739ac9a3e
SHA1

5efeae9253f740401a84399065962b1778150d5b
SHA256

93b724536b967684749bea31324efe53ad6c82af3a364e40b14850c6eb85f954
SHA512

e4782e3d2ef0fa05d5ab0fa138f70c2aeeeee05fb3c206aab73b850f749d30fbfd3e1ae9ab5e0f7dec2f6c10ccb1f49a9bebc3e39ff2b1b4e5b55d3015a66537
SSDEEP

384:+5MPeShoDsI/CRraShz4dMCyqKzkW9c8ZrwzCFUOUGvHaWVbk:++Pzo4M0raG47yLkW9curwzCyFG/

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4332	5092	WerFault.exe	88

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2860 wrote to memory of 5092	2860	rundll32.exe	88
PID 2860 wrote to memory of 5092	2860	rundll32.exe	88
PID 2860 wrote to memory of 5092	2860	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fa892d6eed0066286bb93df739ac9a3e_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2860
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\fa892d6eed0066286bb93df739ac9a3e_JaffaCakes118.dll,#1
  2⤵
  PID:5092
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5092 -s 632
    3⤵
    - Program crash
    PID:4332

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 5092 -ip 5092
1⤵
PID:3952