63e85c25d91a3d5e708c2d3974dbd0224745c2d474a0333f0ee8d40ba00cc18b

Analysis

max time kernel
147s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
11/06/2024, 20:22

Target

9f6ce04c89274e7fc0735e3a4e81acfa_JaffaCakes118.dll
Size

438KB
MD5

9f6ce04c89274e7fc0735e3a4e81acfa
SHA1

72fefd5319ca008fa152126b79fddc1dcbe1cf5b
SHA256

63e85c25d91a3d5e708c2d3974dbd0224745c2d474a0333f0ee8d40ba00cc18b
SHA512

453cb76b3372cc3e15b14d18c4b758fbc0c226808153b38fd51c8ec38b42ce54489e77292dba6b566312aa2d8194983c8bc478b2afb98f795d8d49b36e51be87
SSDEEP

12288:PGUx6+QQFaPkhvAkPE6FNtGPmJ3e4tkP5RPdqlQaF:e2XAkL3tO74tkolL

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3936	464	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5052 wrote to memory of 464	5052	rundll32.exe	82
PID 5052 wrote to memory of 464	5052	rundll32.exe	82
PID 5052 wrote to memory of 464	5052	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9f6ce04c89274e7fc0735e3a4e81acfa_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5052
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9f6ce04c89274e7fc0735e3a4e81acfa_JaffaCakes118.dll,#1
  2⤵
  PID:464
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 464 -s 620
    3⤵
    - Program crash
    PID:3936

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 464 -ip 464
1⤵
PID:2856