293621b8224e09b75636aa57e41329bd5def40d6702e59ecda11171fb14676b9

Analysis

max time kernel
93s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
12/05/2024, 01:58

Target

37a8642fe9baefbb0183447c64800b47_JaffaCakes118.dll
Size

5.1MB
MD5

37a8642fe9baefbb0183447c64800b47
SHA1

1041bd21f4799fae055c3cd438087713b5b2ef1a
SHA256

293621b8224e09b75636aa57e41329bd5def40d6702e59ecda11171fb14676b9
SHA512

ee4ce68ee7fd53d8168de723721f4ba9fdd6a92c555e519a909a89106c130ef43b17f95d9d65710c5deb84bc5eeac3ffc3e0fb127b5c26bf7233c275fc35873c
SSDEEP

98304:2GQYwvFmz5Y3XMgK6tHvIxYLGUkh4j5dDCFWIqWpWiNohOuY0k+ZtXBJZW6n/:D1wr3XXK6NKUkUKFWIqjtV/tXBJZW6n/

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3396	3568	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3356 wrote to memory of 3568	3356	rundll32.exe	82
PID 3356 wrote to memory of 3568	3356	rundll32.exe	82
PID 3356 wrote to memory of 3568	3356	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\37a8642fe9baefbb0183447c64800b47_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3356
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\37a8642fe9baefbb0183447c64800b47_JaffaCakes118.dll,#1
  2⤵
  PID:3568
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3568 -s 660
    3⤵
    - Program crash
    PID:3396

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3568 -ip 3568
1⤵
PID:3552