e8e6e66dfaec2d1bb7222144d85de1e9fdcd9b122b3684b70b27f101b3fde6b5

Analysis

max time kernel
133s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
30/05/2024, 08:55

Target

83a413f7f11dc9b34e0aed9e84230928_JaffaCakes118.dll
Size

9.2MB
MD5

83a413f7f11dc9b34e0aed9e84230928
SHA1

782e16e22940358029950bf149fc8c1eff62fd59
SHA256

e8e6e66dfaec2d1bb7222144d85de1e9fdcd9b122b3684b70b27f101b3fde6b5
SHA512

3310ec41fc0f28148ea3c0cb446f5d46dc0ce3b7779c7c445ec1bde27147e928a4038b20f42b801bf7d48c7ed2edab5655677f3daff9c5e8e2c1244dff1616ba
SSDEEP

196608:5XvrFfmeZxlJftcOSMF7meqhbgFchbKRzHxL:5XFZpFchmT

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2388	3624	WerFault.exe	82

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3624	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3528 wrote to memory of 3624	3528	rundll32.exe	82
PID 3528 wrote to memory of 3624	3528	rundll32.exe	82
PID 3528 wrote to memory of 3624	3528	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\83a413f7f11dc9b34e0aed9e84230928_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3528
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\83a413f7f11dc9b34e0aed9e84230928_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:3624
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3624 -s 660
    3⤵
    - Program crash
    PID:2388

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3624 -ip 3624
1⤵
PID:1812

memory/3624-1-0x0000000002310000-0x0000000002C5A000-memory.dmp

Filesize
9.3MB

Download
memory/3624-2-0x0000000002CF0000-0x0000000002CF1000-memory.dmp

Filesize
4KB

Download