e974c84d97db4fca0a09795ce45a5f56449e0fc35f966c924a8aba70d70b40b5

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
01/06/2024, 23:06

Target
8c193dba75f72892bb7b2a51e5a2d7cd_JaffaCakes118.dll
Size 192KB
Sample240601-23c1esaf87
SHA256 e974c84d97db4fca0a09795ce45a5f56449e0fc35f966c924a8aba70d70b40b5
MD5 8c193dba75f72892bb7b2a51e5a2d7cd
SHA1 f66ffe91d76e5d2288d7b18fd1992df80500ff83
SHA512 745f4a5fa9db02c0c94951b58393372c2736b49f13faa038f92e769811a9f25e901b4d95c4a33d4e2635a7d0c829ff68212e627f2ea57bb8a6cd222c80510c42
SSDEEP 3072:xqkkr3Owrt4DtSOnmS0yolSVtlL780kUY15e5T/:xgn48XjSVr380A
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1268	4316	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3856 wrote to memory of 4316	3856	rundll32.exe	82
PID 3856 wrote to memory of 4316	3856	rundll32.exe	82
PID 3856 wrote to memory of 4316	3856	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8c193dba75f72892bb7b2a51e5a2d7cd_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3856
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\8c193dba75f72892bb7b2a51e5a2d7cd_JaffaCakes118.dll,#1
  2⤵
  PID:4316
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4316 -s 680
    3⤵
    - Program crash
    PID:1268

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4316 -ip 4316
1⤵
PID:4332