0307ee096a52698de3cf3647b36692b328a0a590904faed72e02b071c2b4cd77

Analysis

max time kernel
143s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
21/04/2024, 04:49

Target

fe7874ad0ef50befc50a92401f381ee8_JaffaCakes118.dll
Size

99KB
MD5

fe7874ad0ef50befc50a92401f381ee8
SHA1

7178999bbffac513949793be47b9812855b08748
SHA256

0307ee096a52698de3cf3647b36692b328a0a590904faed72e02b071c2b4cd77
SHA512

2af69f40199a72f7cdad8c143d0b8177d58e8aa026731b02405993975a1596ca25138c412075055d7b702375223349ff9efd8de71bd2a0181d9c26ff42034b4c
SSDEEP

3072:VfYQg/wMEmUQctaceqDtc3/f1ykUMQYU1N:ZYD/wH9a/sqf1BUMy

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4680	3840	WerFault.exe	86

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1056 wrote to memory of 3840	1056	rundll32.exe	86
PID 1056 wrote to memory of 3840	1056	rundll32.exe	86
PID 1056 wrote to memory of 3840	1056	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe7874ad0ef50befc50a92401f381ee8_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1056
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe7874ad0ef50befc50a92401f381ee8_JaffaCakes118.dll,#1
  2⤵
  PID:3840
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3840 -s 548
    3⤵
    - Program crash
    PID:4680

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 3840 -ip 3840
1⤵
PID:3900