9c2991620db3d433e1f0d493e33f5e0378dfe346bc2a5aaa9175228a8703c8b5

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
19/04/2024, 20:11

Target

fb1509a188e327db3d2b0a57ab2c9bd0_JaffaCakes118.dll
Size

84KB
MD5

fb1509a188e327db3d2b0a57ab2c9bd0
SHA1

97aa2aba96c64e2ffba5e33559aa1c0bd79c1564
SHA256

9c2991620db3d433e1f0d493e33f5e0378dfe346bc2a5aaa9175228a8703c8b5
SHA512

6a5bdf35e87303a21339e6f282c7a5d5ba22b75f484683bf7fd394a743890442f0f328e3978704d453f8103cd0ba38c1fa2e238c7e61a4a3061ae09edeeacc61
SSDEEP

1536:G+NPi9z0loXmhhYW+kIKdPmiL8ZAXqvhCKHi5+QiKprz:G+NKuoWh6WzISNL8ZZpe6uz

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4724	4804	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3536 wrote to memory of 4804	3536	rundll32.exe	84
PID 3536 wrote to memory of 4804	3536	rundll32.exe	84
PID 3536 wrote to memory of 4804	3536	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fb1509a188e327db3d2b0a57ab2c9bd0_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3536
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\fb1509a188e327db3d2b0a57ab2c9bd0_JaffaCakes118.dll,#1
  2⤵
  PID:4804
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4804 -s 580
    3⤵
    - Program crash
    PID:4724

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 4804 -ip 4804
1⤵
PID:3592

memory/4804-0-0x0000000002700000-0x00000000027E7000-memory.dmp

Filesize
924KB

Download