3cc84f0064458ce6aa5fc0baf5fd3fd3c42aed7895b332dd34feed72cf3f75f7

Analysis

max time kernel
130s
max time network
100s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22/05/2024, 19:13

Target

6852280400ef005033fbe0fc03dfa3be_JaffaCakes118.dll
Size

153KB
MD5

6852280400ef005033fbe0fc03dfa3be
SHA1

86827bb97e622fdc84df04678f5be2dc9cc9ee2d
SHA256

3cc84f0064458ce6aa5fc0baf5fd3fd3c42aed7895b332dd34feed72cf3f75f7
SHA512

8c808eae5af37d2c307d7958236a6e07738bad2a9a53928f4e59035bfc81f980e40bbfd07ffed8386450386738eb97f710404b59c9cf78f9883d002fddab5f45
SSDEEP

3072:TiE1U5jmVJ6Cxv2MOX3pwi4ThazNEjLdur561d:CjAfxv2bXe6EVq52

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4444	4840	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3496 wrote to memory of 4840	3496	rundll32.exe	82
PID 3496 wrote to memory of 4840	3496	rundll32.exe	82
PID 3496 wrote to memory of 4840	3496	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6852280400ef005033fbe0fc03dfa3be_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3496
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6852280400ef005033fbe0fc03dfa3be_JaffaCakes118.dll,#1
  2⤵
  PID:4840
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4840 -s 680
    3⤵
    - Program crash
    PID:4444

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4840 -ip 4840
1⤵
PID:4396

memory/4840-0-0x0000000010000000-0x000000001006F000-memory.dmp

Filesize
444KB

Download
memory/4840-2-0x0000000010000000-0x000000001006F000-memory.dmp

Filesize
444KB

Download