b773a012b92c2b0d0b5546de693fa660098979c500f11cb2862dd846c3847877

Analysis

max time kernel
51s
max time network
51s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
20/06/2024, 03:25

Target

0265a122bc60a3531e39dc7e68ffbb7a_JaffaCakes118.dll
Size

101KB
MD5

0265a122bc60a3531e39dc7e68ffbb7a
SHA1

297118b9c20071e906df465455d1b039ce31be64
SHA256

b773a012b92c2b0d0b5546de693fa660098979c500f11cb2862dd846c3847877
SHA512

c72b8e804402a1d54f758ba1a2797ca5b4b1074fbc72b619eae3836268e18dc555e4d67285e9f6dbba463025ebf3cd02435f3132e3fdbebf2382ef4be9d5f803
SSDEEP

1536:lkUU3CcEAGZtmx5OHhysevBk/FiAtDSU61o55n+0247qDwVPOwNsRfS64kx/w86:/UEBAKH9eQiAtuiG0J7q+vs5Z4kW3

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4948	4392	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2068 wrote to memory of 4392	2068	rundll32.exe	81
PID 2068 wrote to memory of 4392	2068	rundll32.exe	81
PID 2068 wrote to memory of 4392	2068	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0265a122bc60a3531e39dc7e68ffbb7a_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2068
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0265a122bc60a3531e39dc7e68ffbb7a_JaffaCakes118.dll,#1
  2⤵
  PID:4392
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4392 -s 544
    3⤵
    - Program crash
    PID:4948

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4392 -ip 4392
1⤵
PID:4636

memory/4392-0-0x0000000010000000-0x000000001002F000-memory.dmp

Filesize
188KB

Download