01ac5f73d05a62a0a65e095a7c8bbf5c0674cfb2467e45a63f684e2e57672761

Analysis

max time kernel
51s
max time network
52s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
20/06/2024, 01:58

Target

01dced435ae4d19b5e2d6f6e5b2851f3_JaffaCakes118.dll
Size

150KB
MD5

01dced435ae4d19b5e2d6f6e5b2851f3
SHA1

ed7db15862a9bd3a8600a819230666ef85b1b6c6
SHA256

01ac5f73d05a62a0a65e095a7c8bbf5c0674cfb2467e45a63f684e2e57672761
SHA512

60342cab5c109a7fa4986db40772ff1c4c89105b8c691e18d80084b92024371036744c59e12d197da8d822a7f49ae529989ee470078a3d153530f3d3c8f49d7d
SSDEEP

3072:suhE6zRkox+J7A5neHD9Z2+/cEX5+QP2H9QsewqpGb8:suhrx6HD9Z280QP2H9r2G

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1176	1124	WerFault.exe	82
1340	1124	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3356 wrote to memory of 1124	3356	rundll32.exe	82
PID 3356 wrote to memory of 1124	3356	rundll32.exe	82
PID 3356 wrote to memory of 1124	3356	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\01dced435ae4d19b5e2d6f6e5b2851f3_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3356
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\01dced435ae4d19b5e2d6f6e5b2851f3_JaffaCakes118.dll,#1
  2⤵
  PID:1124
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1124 -s 544
    3⤵
    - Program crash
    PID:1176
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1124 -s 792
    3⤵
    - Program crash
    PID:1340

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 1124 -ip 1124
1⤵
PID:4824

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 1124 -ip 1124
1⤵
PID:2304