ebbc41b1dac63179c47da1561a089bef27d0e23c914f5d00f33376a83a8b7eeb

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
20/06/2024, 15:46

Target

076c90e7b1a9eac0dbe1f103c9a374a5_JaffaCakes118.dll
Size

62KB
MD5

076c90e7b1a9eac0dbe1f103c9a374a5
SHA1

c78990c26154b780be5e79206655e38dbc622e7b
SHA256

ebbc41b1dac63179c47da1561a089bef27d0e23c914f5d00f33376a83a8b7eeb
SHA512

568d46805ed6dfc7b0eb91426de257a6ae6eb25d06e7e73b97d5c9cb70332c6ccfd2f06354897b63c27efe8ecf4be2af416d12f392bf8cb2b00456ffcf1b0273
SSDEEP

1536:apW0NI+TTQpbKSjEpHgJFUJ5Dwyk0Ez3EAZBKzlf:2XbTQVKSIpHKUJPk0Ez3EAZBKf

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4476	3116	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4656 wrote to memory of 3116	4656	rundll32.exe	81
PID 4656 wrote to memory of 3116	4656	rundll32.exe	81
PID 4656 wrote to memory of 3116	4656	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\076c90e7b1a9eac0dbe1f103c9a374a5_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4656
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\076c90e7b1a9eac0dbe1f103c9a374a5_JaffaCakes118.dll,#1
  2⤵
  PID:3116
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3116 -s 548
    3⤵
    - Program crash
    PID:4476

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 3116 -ip 3116
1⤵
PID:3448

memory/3116-0-0x0000000010000000-0x0000000010037000-memory.dmp

Filesize
220KB

Download