f12189029882e631f3cd1e55b1492aea636d610cb82d2b83bac8852df828bd7d

Analysis

max time kernel
124s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
20/06/2024, 01:24

Target

01b07cb4295ee41ebdca46789e762e35_JaffaCakes118.dll
Size

40KB
MD5

01b07cb4295ee41ebdca46789e762e35
SHA1

70f71cc3f1d2a030adbf316cb1e6c568ae1956cd
SHA256

f12189029882e631f3cd1e55b1492aea636d610cb82d2b83bac8852df828bd7d
SHA512

b720a3614d1006b3cd3d3a3708884dc9dd4436592d2043a8e47448d0de03af374c1a78872d503f5ca1d48c87d3f7b1b2b04474edfa8ccdbcdaf3e54b9da40a74
SSDEEP

384:rcPTLFwVtTr45Raf3/iDYABg3/cte5i5RBR0769m5hxGXI3h+dvGIuIINQuac0M+:sypoi3KDo3/Iec79exGKA4ImNQuF9i

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1372	3252	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 640 wrote to memory of 3252	640	rundll32.exe	83
PID 640 wrote to memory of 3252	640	rundll32.exe	83
PID 640 wrote to memory of 3252	640	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\01b07cb4295ee41ebdca46789e762e35_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:640
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\01b07cb4295ee41ebdca46789e762e35_JaffaCakes118.dll,#1
  2⤵
  PID:3252
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3252 -s 628
    3⤵
    - Program crash
    PID:1372

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3252 -ip 3252
1⤵
PID:1324