8648eb7460b436cf3ca07088e3563c940262a9ac7e9589ff2e37a8c5a5ff84fd

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
20-05-2024 13:53

Target

5f6c2092289032b7a248bd83fd5fe504_JaffaCakes118.dll
Size

202KB
MD5

5f6c2092289032b7a248bd83fd5fe504
SHA1

fe1d507df5c79f2a4b359d19ff5387d742115edb
SHA256

8648eb7460b436cf3ca07088e3563c940262a9ac7e9589ff2e37a8c5a5ff84fd
SHA512

871ae96d232df4eb7afcc7001559ea012edb3464ed65dbd0a67184eae062b74b2d30b2a0292c42281fc091bb168957a1d7350ccb401e80919ac91eb7c97b39be
SSDEEP

3072:Pjh9N4a1j712h9Td2+1lxvTeZna8xUhUbT15T0:PjdFKdoSxvixTxUAg

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3488 1384 WerFault.exe rundll32.exe

pid	pid_target	process	target process
3488	1384	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2092 wrote to memory of 1384	2092	rundll32.exe	rundll32.exe
PID 2092 wrote to memory of 1384	2092	rundll32.exe	rundll32.exe
PID 2092 wrote to memory of 1384	2092	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5f6c2092289032b7a248bd83fd5fe504_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2092

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5f6c2092289032b7a248bd83fd5fe504_JaffaCakes118.dll,#1
2⤵
PID:1384

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1384 -s 680
3⤵
- Program crash
PID:3488

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1384 -ip 1384
1⤵
PID:860