4f19e8ad3f10c492a6bdb0c1721cbca2ac029918a7cac66002a3aeb84aca970a

Analysis

max time kernel
51s
max time network
51s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
20/06/2024, 02:32

Target

0210a5ac2b59ecfae6a7ffaa08995449_JaffaCakes118.dll
Size

72KB
MD5

0210a5ac2b59ecfae6a7ffaa08995449
SHA1

d5958f0d49fad8ea0de63127049845384caec2c7
SHA256

4f19e8ad3f10c492a6bdb0c1721cbca2ac029918a7cac66002a3aeb84aca970a
SHA512

91115615ec8e171926e0456daaf89131b4be97ce48111760c80230aebcde0cf741cec09f7907ce7852306ae15a2b9330e73ef1a40fe60b4c26a610031df4458c
SSDEEP

1536:Sjjl3nwzSuOqBubw/WgT6zMKAOK2lCWcQajhRuP:C5UOq0ukgOK2l7aFQP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1516	3380	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 636 wrote to memory of 3380	636	rundll32.exe	81
PID 636 wrote to memory of 3380	636	rundll32.exe	81
PID 636 wrote to memory of 3380	636	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0210a5ac2b59ecfae6a7ffaa08995449_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:636
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0210a5ac2b59ecfae6a7ffaa08995449_JaffaCakes118.dll,#1
  2⤵
  PID:3380
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3380 -s 600
    3⤵
    - Program crash
    PID:1516

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 3380 -ip 3380
1⤵
PID:2148