a5064b12fef4ad904c8d7f9b2318692161d8ab56f607a2b8deb60f0000b3aebc

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
20/05/2024, 04:54

Target

5d4724c570167c5a2337fff3b6d3e126_JaffaCakes118.dll
Size

303KB
MD5

5d4724c570167c5a2337fff3b6d3e126
SHA1

93ee271774b2dc13787a8a1bdba7c22b01612ccb
SHA256

a5064b12fef4ad904c8d7f9b2318692161d8ab56f607a2b8deb60f0000b3aebc
SHA512

dfa0e1bc065add57ab234531fb62e895cd6cf841555c79b3f0ec165bf9f3c97b969d24e6f3e878681b8a6682f5d5b8183f062692e9c27c5466280fffbd4bf776
SSDEEP

3072:KWIJs+D/Sm7MlB4wSw2zjCbGeRFnEgQY4ZIUyVC5FOje+3AQEpI5nX2ptAK:KHsnKK6rzjmGekk4ZeVC5cjhvoIBGp

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4084	3964	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1396 wrote to memory of 3964	1396	rundll32.exe	83
PID 1396 wrote to memory of 3964	1396	rundll32.exe	83
PID 1396 wrote to memory of 3964	1396	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5d4724c570167c5a2337fff3b6d3e126_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1396
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5d4724c570167c5a2337fff3b6d3e126_JaffaCakes118.dll,#1
  2⤵
  PID:3964
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3964 -s 600
    3⤵
    - Program crash
    PID:4084

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3964 -ip 3964
1⤵
PID:1980