113fd3586827be213c378612f37f1ddc6bc2d5fc3e35730d2de89dee02934fd9

Analysis

max time kernel
51s
max time network
51s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
20/06/2024, 01:14

Target

01a430c2b09f8c8b6cb3d45cfc0a446d_JaffaCakes118.dll
Size

89KB
MD5

01a430c2b09f8c8b6cb3d45cfc0a446d
SHA1

36347a09d409b2d3aca98fb263bdcafe745c7a01
SHA256

113fd3586827be213c378612f37f1ddc6bc2d5fc3e35730d2de89dee02934fd9
SHA512

be401cadfccd145a1215ac59dfc77e64d91d97def1f090c8977df1daae496ba91608350b315e9ff41aa4c65cfc06e86b4bc9fd14a9548cf86fee9a8520519d91
SSDEEP

1536:tOkjA7gyy5i6pXURXtA5Qee2bQRYCH3cYfpHsgQe:tqQ5iPQ59z+YCXlHsg9

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1960	4056	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1640 wrote to memory of 4056	1640	rundll32.exe	82
PID 1640 wrote to memory of 4056	1640	rundll32.exe	82
PID 1640 wrote to memory of 4056	1640	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\01a430c2b09f8c8b6cb3d45cfc0a446d_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1640
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\01a430c2b09f8c8b6cb3d45cfc0a446d_JaffaCakes118.dll,#1
  2⤵
  PID:4056
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4056 -s 568
    3⤵
    - Program crash
    PID:1960

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4056 -ip 4056
1⤵
PID:4664

memory/4056-0-0x0000000010000000-0x0000000010029000-memory.dmp

Filesize
164KB

Download