5fe889942aa569dd93a8c3292d49f3ea3fb4455508fc66fd6d6e0e1f7aa409c2

Analysis

max time kernel
150s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
26/04/2024, 08:38

Target

0064125748b7cb441fad787165d34e7b_JaffaCakes118.dll
Size

121KB
MD5

0064125748b7cb441fad787165d34e7b
SHA1

34c439aa821b8c452d7c0ff302583fa40a18d11a
SHA256

5fe889942aa569dd93a8c3292d49f3ea3fb4455508fc66fd6d6e0e1f7aa409c2
SHA512

5af005f7f0db29b5dffb17a0cc4381ec6803ebca45fd345b7df3ffa08da90780fe31f0ff4137542eb8ff434a94accd3051087c0e318116de77a2397561d9ec9a
SSDEEP

1536:sC0eZ1t5HnwfdOFSw0BMwBfDLbyUsLPhyOzPNgPwK3+vH:s7z0wBfDL9sLPssPNgI7

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4604	2452	WerFault.exe	86

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2444 wrote to memory of 2452	2444	rundll32.exe	86
PID 2444 wrote to memory of 2452	2444	rundll32.exe	86
PID 2444 wrote to memory of 2452	2444	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0064125748b7cb441fad787165d34e7b_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2444
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0064125748b7cb441fad787165d34e7b_JaffaCakes118.dll,#1
  2⤵
  PID:2452
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2452 -s 564
    3⤵
    - Program crash
    PID:4604

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 2452 -ip 2452
1⤵
PID:4988