0dc9b810ce9fc9cd1e06899a0fbf168f6d39356acda14128a943ac17901576f0

Analysis

max time kernel
135s
max time network
106s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
26/05/2024, 08:33

Target

74e528ee0b6d1c046285f7fec3576969_JaffaCakes118.dll
Size

4.0MB
MD5

74e528ee0b6d1c046285f7fec3576969
SHA1

52c12abdc468697e72e5bd8bf6e1160ae4e99181
SHA256

0dc9b810ce9fc9cd1e06899a0fbf168f6d39356acda14128a943ac17901576f0
SHA512

f53a6ff0f2ed0def19e6975cd883ff14413335c7e49af85334c080dec0591c90f5921f3d84bb0d346ecd7e54a75f2f7a1502d7e75e83789bc14122c27d28c70f
SSDEEP

98304:B+1JVMtzfjHiZPmGW6K76AXUDA8VA6BLKoB:B+VkXHilXWT7vXF6ooB

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4712	1820	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3464 wrote to memory of 1820	3464	rundll32.exe	82
PID 3464 wrote to memory of 1820	3464	rundll32.exe	82
PID 3464 wrote to memory of 1820	3464	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\74e528ee0b6d1c046285f7fec3576969_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3464
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\74e528ee0b6d1c046285f7fec3576969_JaffaCakes118.dll,#1
  2⤵
  PID:1820
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1820 -s 660
    3⤵
    - Program crash
    PID:4712

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1820 -ip 1820
1⤵
PID:3596