67c771d4d01def6147dd8571c079ea2ea6882ee833cbd5762204f4777dba10ce

Analysis

max time kernel
139s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
21/05/2024, 00:04

Target

61645330c61a316c542aad1ef828847a_JaffaCakes118.dll
Size

1.3MB
MD5

61645330c61a316c542aad1ef828847a
SHA1

1700ec5dc4f28e0bc6130130a12200bff68d2e32
SHA256

67c771d4d01def6147dd8571c079ea2ea6882ee833cbd5762204f4777dba10ce
SHA512

0c55e3df80c89d67ed6df9f6d5582b5a1fbd0f6d61fc2aae824d216209a45ae7af20dd2ca5b7daf2cf79feebe9da933225688b64674a6135935ec3776fa3e7d2
SSDEEP

24576:QlJLVH14k9zWnWM2SSEQWmQVyddaoHQEQOeS/riT52c:uJN1RFl0Qd9IfS/r052c

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4948	2160	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2364 wrote to memory of 2160	2364	rundll32.exe	82
PID 2364 wrote to memory of 2160	2364	rundll32.exe	82
PID 2364 wrote to memory of 2160	2364	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\61645330c61a316c542aad1ef828847a_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2364
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\61645330c61a316c542aad1ef828847a_JaffaCakes118.dll,#1
  2⤵
  PID:2160
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2160 -s 728
    3⤵
    - Program crash
    PID:4948

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 2160 -ip 2160
1⤵
PID:3984

memory/2160-0-0x00000000022E0000-0x0000000002437000-memory.dmp

Filesize
1.3MB

Download
memory/2160-1-0x0000000000700000-0x0000000000701000-memory.dmp

Filesize
4KB

Download
memory/2160-2-0x00000000022E0000-0x0000000002437000-memory.dmp

Filesize
1.3MB

Download