f31b950cddeedb9120a5a98d4b3cd3a5a35818048b310bbf9a54a23732055133

Analysis

max time kernel
51s
max time network
51s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
20-06-2024 08:39

Target

04698902faaa9fc25f25924648dd69b8_JaffaCakes118.dll
Size

58KB
MD5

04698902faaa9fc25f25924648dd69b8
SHA1

2cf5dc3d1c56788c352e437e6b846868e154c4c2
SHA256

f31b950cddeedb9120a5a98d4b3cd3a5a35818048b310bbf9a54a23732055133
SHA512

3a815cfe69caa030cacf248bfb8aac84c62b543986de2e1bb485f9dc97bc403cd0019f405200b738c5f2de857665a8b3881e799ae82270a74f0dfe8b0b47359a
SSDEEP

1536:F7hligalhWrS5jyDoIWKfycLRccbWEt09Zfad8XV:Fd/af7I5gK0nXV

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
404	3196	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 764 wrote to memory of 3196	764	rundll32.exe	82
PID 764 wrote to memory of 3196	764	rundll32.exe	82
PID 764 wrote to memory of 3196	764	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\04698902faaa9fc25f25924648dd69b8_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:764
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\04698902faaa9fc25f25924648dd69b8_JaffaCakes118.dll,#1
  2⤵
  PID:3196
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3196 -s 544
    3⤵
    - Program crash
    PID:404

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3196 -ip 3196
1⤵
PID:224

memory/3196-0-0x00000000009B0000-0x0000000000A00000-memory.dmp

Filesize
320KB

Download