00b1026ac1c50f331e97f045ff1e19ea4d289073ce1cc53b09302d02784e4426

Analysis

max time kernel
129s
max time network
98s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 00:05

Target

6549eac35a9427c1b5d294da088e6730_JaffaCakes118.dll
Size

202KB
MD5

6549eac35a9427c1b5d294da088e6730
SHA1

b0dc18d67b60b3190f9548d192d2295e925c69e8
SHA256

00b1026ac1c50f331e97f045ff1e19ea4d289073ce1cc53b09302d02784e4426
SHA512

32cf462761d5813b8983507ed34af31e78b0c45d6bd1c536722233cd71e130f99b0705fb1216f7a4d6071b9fec510021adce675c3137c17addb1fdd0cdfa49d4
SSDEEP

3072:Pjh9N4a1j712h9Td2+1lxvTeZna8xUhUbT15j:PjdFKdoSxvixTxUA

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1888 1648 WerFault.exe rundll32.exe

pid	pid_target	process	target process
1888	1648	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3776 wrote to memory of 1648	3776	rundll32.exe	rundll32.exe
PID 3776 wrote to memory of 1648	3776	rundll32.exe	rundll32.exe
PID 3776 wrote to memory of 1648	3776	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6549eac35a9427c1b5d294da088e6730_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3776

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6549eac35a9427c1b5d294da088e6730_JaffaCakes118.dll,#1
2⤵
PID:1648

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1648 -s 680
3⤵
- Program crash
PID:1888

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1648 -ip 1648
1⤵
PID:4976