33da577ee7b678badd45eb9397260499c939598b97d78e56680b03f959e1e139

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
21/04/2024, 07:48

Target

fecbb17e5cb7597b42599cca9f237c07_JaffaCakes118.dll
Size

144KB
MD5

fecbb17e5cb7597b42599cca9f237c07
SHA1

72ae165a7f94bcc20b5e31b5c1448e3123ecefc0
SHA256

33da577ee7b678badd45eb9397260499c939598b97d78e56680b03f959e1e139
SHA512

c329860a013b3f41102c1a95d9f811a6173eaa9f2610bb43eb50e698a79784843c99fc1bbc6af649be287d09c7fe8fb71a8b740efa6274dfd3397f5a01b36bd2
SSDEEP

3072:xsJktXqkaAp78heywCtFUulf5oKCrOlFHmg8t8vCS5:/tXqkaa4hzwadVyg8WCS5

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1964	2952	WerFault.exe	86

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 472 wrote to memory of 2952	472	rundll32.exe	86
PID 472 wrote to memory of 2952	472	rundll32.exe	86
PID 472 wrote to memory of 2952	472	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fecbb17e5cb7597b42599cca9f237c07_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:472
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\fecbb17e5cb7597b42599cca9f237c07_JaffaCakes118.dll,#1
  2⤵
  PID:2952
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2952 -s 600
    3⤵
    - Program crash
    PID:1964

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 2952 -ip 2952
1⤵
PID:400

memory/2952-0-0x000000006D0C0000-0x000000006D0E4000-memory.dmp

Filesize
144KB

Download