79d3f6871f6782ccd82d5f13fc8a179963b326b846261f3149b6a09fe6c7b622

Analysis

max time kernel
94s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
24/06/2024, 23:25

Target

0b3e3f86fee217ee97dd90f7f3a1ef2e_JaffaCakes118.dll
Size

230KB
MD5

0b3e3f86fee217ee97dd90f7f3a1ef2e
SHA1

bd3bd65d7eaf824b8917b25d5facfbf8193daeb6
SHA256

79d3f6871f6782ccd82d5f13fc8a179963b326b846261f3149b6a09fe6c7b622
SHA512

2af75afa378c72952dd7ef72e4339ce06302d2c484c4042dc832f89ba2e43cb9209fe2a2770cd4517d5200c71eb8dd61ae63da3979b2363a582c62ddfa7856d9
SSDEEP

3072:YqXcvg2FnG5Xcgt9WYAUt6HPAynM/Sqfvm1mqZAGYj4XYnzWEO6f4TxKKnG3WvtN:jfhRLLArvAtd8mqSLz/ITA08WFdc

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3592	1292	WerFault.exe	81
2800	1292	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4824 wrote to memory of 1292	4824	rundll32.exe	81
PID 4824 wrote to memory of 1292	4824	rundll32.exe	81
PID 4824 wrote to memory of 1292	4824	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0b3e3f86fee217ee97dd90f7f3a1ef2e_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4824
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0b3e3f86fee217ee97dd90f7f3a1ef2e_JaffaCakes118.dll,#1
  2⤵
  PID:1292
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1292 -s 580
    3⤵
    - Program crash
    PID:3592
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1292 -s 564
    3⤵
    - Program crash
    PID:2800

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1292 -ip 1292
1⤵
PID:3200

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 1292 -ip 1292
1⤵
PID:3752