37a3fd53e4a1e7fb5f377271123c5c115851ae1f92912b6f79cb263d6fe79e19

Analysis

max time kernel
51s
max time network
51s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
19/06/2024, 22:59

Target

0106cf516fca017962bd0cf957861a45_JaffaCakes118.dll
Size

135KB
MD5

0106cf516fca017962bd0cf957861a45
SHA1

2ddf70ff0f2ed01e452e7dd36ccec6015ed0289c
SHA256

37a3fd53e4a1e7fb5f377271123c5c115851ae1f92912b6f79cb263d6fe79e19
SHA512

f8151bbf8c133172cb9d38392412276d3e6e1c4a843ea9f9d8184de9b947e85be6b1092fac8e9f573e29b9ead379bc7ebe0de1125cd6e811265a7cdb2e4cc2f4
SSDEEP

1536:nuSM379pilzy4aCUBGbrufhif3ba/Qtps4zWeYXuOtMla:nu79WdaC2urufq33UeYuOH

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2064	4204	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4604 wrote to memory of 4204	4604	rundll32.exe	82
PID 4604 wrote to memory of 4204	4604	rundll32.exe	82
PID 4604 wrote to memory of 4204	4604	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0106cf516fca017962bd0cf957861a45_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4604
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0106cf516fca017962bd0cf957861a45_JaffaCakes118.dll,#1
  2⤵
  PID:4204
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4204 -s 572
    3⤵
    - Program crash
    PID:2064

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4204 -ip 4204
1⤵
PID:1500