d1f8607f8cd2021289cba87bb4f8038996914114c540e22405b63fb932d710a3

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
16-05-2024 17:05

Target

4c2444a444c3ebc60029644fe536542f_JaffaCakes118.dll
Size

2.8MB
MD5

4c2444a444c3ebc60029644fe536542f
SHA1

44c4d50f02189fa35643e303eae68a42c36b7b93
SHA256

d1f8607f8cd2021289cba87bb4f8038996914114c540e22405b63fb932d710a3
SHA512

3fa8884c60285b1b11c358d24780907a81b1670b53159defbd2597f8c42b51bbdb6d4c9f32a0d892d47dac34c815c31df94ef6a4bbb9a11b5d3182666175642e
SSDEEP

49152:Mne9zZoDyY7y6e9Kd/MDzTVh0f6pG9vMopi8Ks5afnRWEVihoHoKiI9cX:LRZoDyee9KKVa6pG9EN8Ks5af0Ewi3M

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5104	3088	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2916 wrote to memory of 3088	2916	rundll32.exe	82
PID 2916 wrote to memory of 3088	2916	rundll32.exe	82
PID 2916 wrote to memory of 3088	2916	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4c2444a444c3ebc60029644fe536542f_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2916
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4c2444a444c3ebc60029644fe536542f_JaffaCakes118.dll,#1
  2⤵
  PID:3088
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3088 -s 660
    3⤵
    - Program crash
    PID:5104

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 3088 -ip 3088
1⤵
PID:4608