785b86cc910d5072b6fc24235e3374aa98137a8d30a95041aef3fd611883c562

Analysis

max time kernel
140s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
15-05-2024 23:31

Target

488fe190625e8fb934b2724362112ea2_JaffaCakes118.dll
Size

2.8MB
MD5

488fe190625e8fb934b2724362112ea2
SHA1

c56fde38ecb807d79feeb5072ff1aae3470a657b
SHA256

785b86cc910d5072b6fc24235e3374aa98137a8d30a95041aef3fd611883c562
SHA512

ff84d369873fb492f16399cc8d7aedc71aa2508defaa66041bbdd574938aef17ef338e051e724615a0ee3a276fa650e20d72d5d4cd69585c9586b37d551fc31e
SSDEEP

49152:0fd+nVDb0LLygXtKKrCDAHXsG9vLYwhKRjBte/u+VlFurgMr:U8VDb0JXtKAHXsG9jzhKRjBtp+fYT

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
756	4856	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3096 wrote to memory of 4856	3096	rundll32.exe	82
PID 3096 wrote to memory of 4856	3096	rundll32.exe	82
PID 3096 wrote to memory of 4856	3096	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\488fe190625e8fb934b2724362112ea2_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3096
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\488fe190625e8fb934b2724362112ea2_JaffaCakes118.dll,#1
  2⤵
  PID:4856
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4856 -s 660
    3⤵
    - Program crash
    PID:756

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4856 -ip 4856
1⤵
PID:916