533ebe3a1f9734c30db7ce0462ff6366d09c2df3a3c748cfc261fc9bdbbdc24c

Analysis

max time kernel
136s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22/05/2024, 09:52

Target

66db2090c03e65fc7ffccae8a801b4a6_JaffaCakes118.dll
Size

256KB
MD5

66db2090c03e65fc7ffccae8a801b4a6
SHA1

2369c707ef9c9cba7efd76995e7fcca1bff21ace
SHA256

533ebe3a1f9734c30db7ce0462ff6366d09c2df3a3c748cfc261fc9bdbbdc24c
SHA512

e46318689c5e3e2d8bee07cbf1b5aba99aef026cead2f25100272411eab2f02dcc0dd9011889f3c00ebb4963faed8f37964dca2d8795713afcf3292b039c5c0d
SSDEEP

6144:gMlLg3zG6nqv88Bd9KvxAVXZLEpmSVz/i0Wfk7JEE:XlLeqv88Bd90xmZLrSJ/i0Wfkd

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4376	2996	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3588 wrote to memory of 2996	3588	rundll32.exe	83
PID 3588 wrote to memory of 2996	3588	rundll32.exe	83
PID 3588 wrote to memory of 2996	3588	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\66db2090c03e65fc7ffccae8a801b4a6_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3588
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\66db2090c03e65fc7ffccae8a801b4a6_JaffaCakes118.dll,#1
  2⤵
  PID:2996
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2996 -s 636
    3⤵
    - Program crash
    PID:4376

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 2996 -ip 2996
1⤵
PID:4272