df7bb9439060827d9fd032fb0f53ce9d9090c7e8d971779dbea15ecd3c2728bc

Analysis

max time kernel
147s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
20-04-2024 08:44

Target

fc5e54a1a849c9b9534b02484ffa1565_JaffaCakes118.dll
Size

102KB
MD5

fc5e54a1a849c9b9534b02484ffa1565
SHA1

11de25f4a602b24a17fd02020544358ffa8e556b
SHA256

df7bb9439060827d9fd032fb0f53ce9d9090c7e8d971779dbea15ecd3c2728bc
SHA512

1722f53e5a74e1bcac95a7e9d43fd50058b25daf50d278fc0db87f0d281dbb97908c54ef7b08f55f1eb955ed6478b22952bc7708f2f659a2e6ed74352becb5f7
SSDEEP

3072:VoHEZ21Uiv2iXR1ISOnwuJ0QVrJ/Sz3Hgl:VzcSiaS9Y07zXY

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1080	4844	WerFault.exe	85

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3720 wrote to memory of 4844	3720	rundll32.exe	85
PID 3720 wrote to memory of 4844	3720	rundll32.exe	85
PID 3720 wrote to memory of 4844	3720	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fc5e54a1a849c9b9534b02484ffa1565_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3720
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\fc5e54a1a849c9b9534b02484ffa1565_JaffaCakes118.dll,#1
  2⤵
  PID:4844
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4844 -s 544
    3⤵
    - Program crash
    PID:1080

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4844 -ip 4844
1⤵
PID:632

memory/4844-0-0x0000000010000000-0x000000001002F000-memory.dmp

Filesize
188KB

Download