ec0bfe2a04c4608b204e716751ae3e64fbb928caf937c3f57c76a68459d2cd8c

Analysis

max time kernel
132s
max time network
102s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
07/05/2024, 07:05

Target

1fd2d4a075163cd6dfae8459a5b31a25_JaffaCakes118.dll
Size

2.8MB
MD5

1fd2d4a075163cd6dfae8459a5b31a25
SHA1

eedf52767022950ee6d6ed61e283bd4a1cabfbc2
SHA256

ec0bfe2a04c4608b204e716751ae3e64fbb928caf937c3f57c76a68459d2cd8c
SHA512

88ddee5cfb2adc8543d3e72ec18b313d85546adb7b942be26a38cc65a0bb2fa08a7db903227b4614cb7ab75d4ea9459e480c0da7319a5fa19d8bf18381838366
SSDEEP

49152:DnI9zZoDyY7y6e9Kd6eDjHKQJY2MG9vDpdyMKoUBY2i/WVYamf:sRZoDyee9Kr5W2MG97eMKoUBYrWmR

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1720	1192	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4704 wrote to memory of 1192	4704	rundll32.exe	83
PID 4704 wrote to memory of 1192	4704	rundll32.exe	83
PID 4704 wrote to memory of 1192	4704	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1fd2d4a075163cd6dfae8459a5b31a25_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4704
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1fd2d4a075163cd6dfae8459a5b31a25_JaffaCakes118.dll,#1
  2⤵
  PID:1192
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1192 -s 660
    3⤵
    - Program crash
    PID:1720

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1192 -ip 1192
1⤵
PID:3336