a5bfc887cb312436b103437d6c0bf38e7cb1ba2559f56d5dd436ce3671a8e98b

Analysis

max time kernel
130s
max time network
100s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 10:24

Target
91706163801ab8f3a3ece7d59b758396_JaffaCakes118.dll
Size 204KB
Sample240603-mftmbscd97
SHA256 a5bfc887cb312436b103437d6c0bf38e7cb1ba2559f56d5dd436ce3671a8e98b
MD5 91706163801ab8f3a3ece7d59b758396
SHA1 3b3ce4aa09100e4b7ad435b613f65580f6ae45f9
SHA512 df83de04a0863226bcc349967b988149d4ef645cbfb996d2521579f833121245e62837d6819c8292fe9e660faf5501c409f2e2c174b79647c4fc05b5f785d4a6
SSDEEP 3072:pPnlJEMtMu9RlzV49hcJeUmsGCBtupnsdpyqOL85OtIgkt5BhgoTRmId:dlAu9nzFbNBtLdfOL3ctzH
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1400	3592	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3952 wrote to memory of 3592	3952	rundll32.exe	84
PID 3952 wrote to memory of 3592	3952	rundll32.exe	84
PID 3952 wrote to memory of 3592	3952	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\91706163801ab8f3a3ece7d59b758396_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3952
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\91706163801ab8f3a3ece7d59b758396_JaffaCakes118.dll,#1
  2⤵
  PID:3592
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3592 -s 600
    3⤵
    - Program crash
    PID:1400

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 3592 -ip 3592
1⤵
PID:2644