4de3bc98e92363f3d89149dc8ba08d1eb346ff5b941b8bbefbe941309fb2066d

Analysis

max time kernel
147s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
19-06-2024 20:07

Target

00448e82ae833810aaf68fad38427f6f_JaffaCakes118.dll
Size

362KB
MD5

00448e82ae833810aaf68fad38427f6f
SHA1

91f7f1bf3fc7ae5f4dbb1f01f75fb014b0787869
SHA256

4de3bc98e92363f3d89149dc8ba08d1eb346ff5b941b8bbefbe941309fb2066d
SHA512

135ee5e34957eaa5be707e403501179c39e1e43dc11aacfc50d6ba6cb9a57ffb167a7a36cb1c28015ab375d8cb5e935689aaffb0bc992a21d293daf6ebfeaa6f
SSDEEP

6144:OwM3I4nEYm2WLZz9PGGISkraoIX4NRZLLd/BZpymJZBS+tSfEwv5wyQ:xkI4nJmRz9PGGjkrgoN9Ppymfkn

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3632	3980	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1812 wrote to memory of 3980	1812	rundll32.exe	82
PID 1812 wrote to memory of 3980	1812	rundll32.exe	82
PID 1812 wrote to memory of 3980	1812	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\00448e82ae833810aaf68fad38427f6f_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1812
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\00448e82ae833810aaf68fad38427f6f_JaffaCakes118.dll,#1
  2⤵
  PID:3980
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3980 -s 596
    3⤵
    - Program crash
    PID:3632

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3980 -ip 3980
1⤵
PID:756

memory/3980-0-0x0000000073E70000-0x0000000073ECD000-memory.dmp

Filesize
372KB

Download