8f69df442b562e4d9bb94a5ba62d0bfa6fe25fa7119b015351a9edf7f6a9a8c0

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
02/06/2024, 06:07

Target

8d1f8d0fff66281b11574adf6c3d5a28_JaffaCakes118.dll
Size

395KB
MD5

8d1f8d0fff66281b11574adf6c3d5a28
SHA1

863a0e79f027d47e954744fb73bcfbd3c1448679
SHA256

8f69df442b562e4d9bb94a5ba62d0bfa6fe25fa7119b015351a9edf7f6a9a8c0
SHA512

458ea77718819cac0357571c16199a7415f1dd9c7a252a93aba678a45504235535053a67b1d495f03e864a64f9c23f835627443c70554c6b0d97e8e9efb3b31c
SSDEEP

12288:UbAMjI7gtjyJTP0jSu2y3a9tlBDq3kX/llh:gqDlcr2h9tlBD2kXt

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4632	4592	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1280 wrote to memory of 4592	1280	rundll32.exe	81
PID 1280 wrote to memory of 4592	1280	rundll32.exe	81
PID 1280 wrote to memory of 4592	1280	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8d1f8d0fff66281b11574adf6c3d5a28_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1280
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\8d1f8d0fff66281b11574adf6c3d5a28_JaffaCakes118.dll,#1
  2⤵
  PID:4592
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4592 -s 652
    3⤵
    - Program crash
    PID:4632

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4592 -ip 4592
1⤵
PID:1508