9c29be8fc9ca3c29f6c565737e08db432644ce3709b63a94e07ae9ba81b2b7ae

Analysis

max time kernel
142s
max time network
118s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
17/05/2024, 06:33

Target

4ed3df377f3ee11c0eaa7e4dee62a6d2_JaffaCakes118.dll
Size

375KB
MD5

4ed3df377f3ee11c0eaa7e4dee62a6d2
SHA1

ba1896b479ded891a08b24b66cdd4f769f0e3344
SHA256

9c29be8fc9ca3c29f6c565737e08db432644ce3709b63a94e07ae9ba81b2b7ae
SHA512

a2ecd9f35b7c209e02ae1ac1ec3396b41db7e64c37c0996b21638a020b616716ff033b3edce7885708bf0c8efc8f9d92baabec7f72efb77bf0ca09d027ce7442
SSDEEP

6144:dHv4WIYGoDlbSX1MP4RuoVdavtvVzMGsO8NGtlbO9HOXr2f/LD8lwznqQZF3PJII:FjDheX1MP4iLbcS2ff8lwauh5Vg

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1060	2332	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4200 wrote to memory of 2332	4200	rundll32.exe	82
PID 4200 wrote to memory of 2332	4200	rundll32.exe	82
PID 4200 wrote to memory of 2332	4200	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4ed3df377f3ee11c0eaa7e4dee62a6d2_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4200
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4ed3df377f3ee11c0eaa7e4dee62a6d2_JaffaCakes118.dll,#1
  2⤵
  PID:2332
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2332 -s 560
    3⤵
    - Program crash
    PID:1060

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 2332 -ip 2332
1⤵
PID:3752