4bc46cc8146007b60f72bc42d7d59a55abf943f50fc42dd8a8fa7475e0b775fb

Analysis

max time kernel
93s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
28/04/2024, 13:41

Target

05507d68ea603cb822b5059c02e99f84_JaffaCakes118.dll
Size

35KB
MD5

05507d68ea603cb822b5059c02e99f84
SHA1

aadf086507aeb380387eb8c4457360394578ff95
SHA256

4bc46cc8146007b60f72bc42d7d59a55abf943f50fc42dd8a8fa7475e0b775fb
SHA512

209f4a4df9b9bc715aa56a055a0f636296d5f56383030c3b2d1066029936428178de576471adcbf87394d675bd793d9547a0c9cc6889d3df6668bd242f40fd43
SSDEEP

768:K3TyjThg+N/lzvBGYds9gxmWhUERFP6DyOtR:ke5gUdzZbSgxmW35OtR

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4972	3332	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 904 wrote to memory of 3332	904	rundll32.exe	82
PID 904 wrote to memory of 3332	904	rundll32.exe	82
PID 904 wrote to memory of 3332	904	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\05507d68ea603cb822b5059c02e99f84_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:904
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\05507d68ea603cb822b5059c02e99f84_JaffaCakes118.dll,#1
  2⤵
  PID:3332
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3332 -s 828
    3⤵
    - Program crash
    PID:4972

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3332 -ip 3332
1⤵
PID:3368