20682650bd1b5d46cb9c0cfa1be78227d47bbbe504b4103f29c461887eb22fac

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
11/05/2024, 18:21

Target

35ec693ae8cd5cecb285fa159ca418cb_JaffaCakes118.dll
Size

908KB
MD5

35ec693ae8cd5cecb285fa159ca418cb
SHA1

f01dda26b2247538a5b5068231870128d0a52720
SHA256

20682650bd1b5d46cb9c0cfa1be78227d47bbbe504b4103f29c461887eb22fac
SHA512

848d1c6ad406d23a1b0905a111a7ba61b23b03fd5dbcfdaf30ebe9e99a1149ac34c061c1dde8e0ab91fbc920139a8c56218ca73305e8032c9030ec1651bf9b09
SSDEEP

24576:Hl8JvU4v7QjXxNuv+W9meLPagwarr2eMA0:HOJvU4v7gBsVmeLPpj+ej

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1636	568	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1988 wrote to memory of 568	1988	rundll32.exe	82
PID 1988 wrote to memory of 568	1988	rundll32.exe	82
PID 1988 wrote to memory of 568	1988	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\35ec693ae8cd5cecb285fa159ca418cb_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1988
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\35ec693ae8cd5cecb285fa159ca418cb_JaffaCakes118.dll,#1
  2⤵
  PID:568
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 568 -s 768
    3⤵
    - Program crash
    PID:1636

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 568 -ip 568
1⤵
PID:4000