bb55aa6fb198d5979795d3fb45bc73a1e1cc6f1c56ad97c7337bcf0bd666b128

Analysis

max time kernel
51s
max time network
51s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
11-06-2024 11:45

Target

9e10bb075bf715d7104a2f51ddfcf364_JaffaCakes118.dll
Size

206KB
MD5

9e10bb075bf715d7104a2f51ddfcf364
SHA1

f670594fc7ac9594a240dadd89d8bd836cb5045f
SHA256

bb55aa6fb198d5979795d3fb45bc73a1e1cc6f1c56ad97c7337bcf0bd666b128
SHA512

f9f8443255a56f014ce581f752767103e4d031a0f51661c37857d3eda140d523de7fb50b1f243c3c4c7630d94c8c65ddcbc056bfe29659ed4ce3e1e65e55d7f6
SSDEEP

3072:nrvYXMJJciFoSYMoXYQlwfv/gF8jua3PX4Ns5drwolUtwsVeL5KCuNS:EXkiq4wfv4Kjnv+srwoPAdS

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2756 3060 WerFault.exe rundll32.exe

pid	pid_target	process	target process
2756	3060	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2236 wrote to memory of 3060	2236	rundll32.exe	rundll32.exe
PID 2236 wrote to memory of 3060	2236	rundll32.exe	rundll32.exe
PID 2236 wrote to memory of 3060	2236	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9e10bb075bf715d7104a2f51ddfcf364_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2236

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9e10bb075bf715d7104a2f51ddfcf364_JaffaCakes118.dll,#1
2⤵
PID:3060

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3060 -s 636
3⤵
- Program crash
PID:2756

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 3060 -ip 3060
1⤵
PID:2288