9537239965ef3f5b156a86378501f129e515f480ca1edde76f583fda587e84a3

Analysis

max time kernel
139s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
24/06/2024, 14:34

Target

0916334436bfb46123db4b183ed3c8a1_JaffaCakes118.dll
Size

9KB
MD5

0916334436bfb46123db4b183ed3c8a1
SHA1

a9982190b1bea26b57ee836409a4266e575067d6
SHA256

9537239965ef3f5b156a86378501f129e515f480ca1edde76f583fda587e84a3
SHA512

6c9fed09a4db06b3562efdc8fe827f94db950ce54af106979d9731e9a918527bdb08515dc2c16655276677942e471da7a31fa444b84ecbf546f74eb98e721fd3
SSDEEP

192:w8X6hn5J+xLrSIPM8OO1sm4IfII07vCvdusx3oTup:wOu89PPM8OYsPIn0TCl5Su

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4144	2080	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4120 wrote to memory of 2080	4120	rundll32.exe	83
PID 4120 wrote to memory of 2080	4120	rundll32.exe	83
PID 4120 wrote to memory of 2080	4120	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0916334436bfb46123db4b183ed3c8a1_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4120
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0916334436bfb46123db4b183ed3c8a1_JaffaCakes118.dll,#1
  2⤵
  PID:2080
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2080 -s 600
    3⤵
    - Program crash
    PID:4144

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2080 -ip 2080
1⤵
PID:4504

memory/2080-1-0x00000000008E0000-0x00000000008E1000-memory.dmp

Filesize
4KB

Download
memory/2080-0-0x0000000010000000-0x000000001000A000-memory.dmp

Filesize
40KB

Download