88133cb104e1f6698e1774ad1948568eeef0a967abedb68d1b3a65defe813b62

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
28/04/2024, 19:14

Target

05e341259e5f4f5ea88cfb7fb21ede60_JaffaCakes118.dll
Size

75KB
MD5

05e341259e5f4f5ea88cfb7fb21ede60
SHA1

b98bf699d6319cf7fa060c745fb4c472069e8f75
SHA256

88133cb104e1f6698e1774ad1948568eeef0a967abedb68d1b3a65defe813b62
SHA512

8a16b1dbf0f0ef24168c6af125941625f6e2de6987364d732aaafcebc022b8b7eebd893727d2d543c9657d2c229b07d04c3b4d68a3d2fa3333e8dc17495fbd8a
SSDEEP

1536:TOd7zNJCY0jX0wt0N2c0TWvBTqORjn+buw3:Sd1JQt+F0qvZ/n+bX3

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
868	972	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4020 wrote to memory of 972	4020	rundll32.exe	81
PID 4020 wrote to memory of 972	4020	rundll32.exe	81
PID 4020 wrote to memory of 972	4020	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\05e341259e5f4f5ea88cfb7fb21ede60_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4020
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\05e341259e5f4f5ea88cfb7fb21ede60_JaffaCakes118.dll,#1
  2⤵
  PID:972
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 972 -s 572
    3⤵
    - Program crash
    PID:868

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 972 -ip 972
1⤵
PID:4516