6cd8e62f551f61e738ad05bbb4b904f59d872424c2eca2479ef58516afd043b3

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
12/05/2024, 13:17

Target

3a4d9e60da682e23e97c3b4db3cab4e7_JaffaCakes118.dll
Size

67KB
MD5

3a4d9e60da682e23e97c3b4db3cab4e7
SHA1

857cc2fb8b33773472c11720f87e7ccfd1a18d9a
SHA256

6cd8e62f551f61e738ad05bbb4b904f59d872424c2eca2479ef58516afd043b3
SHA512

29c4f94f1600dee4e778f347de1eff2d03f9f40c35178a8c0a2c01f7bd1536f7abd6ba06226347736d42dee3c3d0aaf37c4f93b682fcac7e6cd790399b53519c
SSDEEP

1536:J8DXLNunSKCSMQCmBYn5JiHuAuW8ImUcXtD1HiUs1xRWUdQpW:J8TEnSyjCmBYuuNaMwRWUdN

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
624	1020	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4132 wrote to memory of 1020	4132	rundll32.exe	81
PID 4132 wrote to memory of 1020	4132	rundll32.exe	81
PID 4132 wrote to memory of 1020	4132	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3a4d9e60da682e23e97c3b4db3cab4e7_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4132
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3a4d9e60da682e23e97c3b4db3cab4e7_JaffaCakes118.dll,#1
  2⤵
  PID:1020
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1020 -s 624
    3⤵
    - Program crash
    PID:624

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1020 -ip 1020
1⤵
PID:1116

memory/1020-0-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download