0e571927df8734920245ea19aac89ad1bfa1095cdb9b7084c38052d862de9064

Analysis

max time kernel
51s
max time network
53s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
20-06-2024 13:38

Target

067dcbe189f95436fcfd4bc075b53df4_JaffaCakes118.dll
Size

14KB
MD5

067dcbe189f95436fcfd4bc075b53df4
SHA1

909333296c7745e80a59e38da50654b91b7c4327
SHA256

0e571927df8734920245ea19aac89ad1bfa1095cdb9b7084c38052d862de9064
SHA512

129bcb200d6d70065090df624826d3e36039ce6a2226dff4e1cd7de14ec2583d6791238c62a4d9e86d6d42aa0dc86006dc48820328be2dcbec14b57a37193212
SSDEEP

192:oJp7aAHXIynXW7p8wKJZ23gB88r8m6VHYjyG17FzfvtEiRZkxBcsn+6ZldRi/vy2:SL5Gcxsm6VHYjyyQcQ+6DdRKvL

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2788	4336	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3008 wrote to memory of 4336	3008	rundll32.exe	82
PID 3008 wrote to memory of 4336	3008	rundll32.exe	82
PID 3008 wrote to memory of 4336	3008	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\067dcbe189f95436fcfd4bc075b53df4_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3008
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\067dcbe189f95436fcfd4bc075b53df4_JaffaCakes118.dll,#1
  2⤵
  PID:4336
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4336 -s 632
    3⤵
    - Program crash
    PID:2788

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4336 -ip 4336
1⤵
PID:4872