607655664ce42cd14dbdc3c7d6d70351f455057a1009d66001171e8f6e7932e8

Analysis

max time kernel
52s
max time network
51s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
24/06/2024, 16:49

Target

09b1a1f59b4257ed85af69a4911df354_JaffaCakes118.dll
Size

2KB
MD5

09b1a1f59b4257ed85af69a4911df354
SHA1

1927070904a03d8e5b183832425940329f8643c6
SHA256

607655664ce42cd14dbdc3c7d6d70351f455057a1009d66001171e8f6e7932e8
SHA512

8be7ba159c46be228a6cb686e70ae888f6c210a56f6363f3cc3d5aa26a8cdf195c7ef1171b2dbc2c035fc8246475592ec5d4af5570614711df1919cf797a1c71

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2264	1236	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2332 wrote to memory of 1236	2332	rundll32.exe	81
PID 2332 wrote to memory of 1236	2332	rundll32.exe	81
PID 2332 wrote to memory of 1236	2332	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\09b1a1f59b4257ed85af69a4911df354_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2332
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\09b1a1f59b4257ed85af69a4911df354_JaffaCakes118.dll,#1
  2⤵
  PID:1236
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1236 -s 544
    3⤵
    - Program crash
    PID:2264

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1236 -ip 1236
1⤵
PID:3756

memory/1236-0-0x0000000010000000-0x000000001008E000-memory.dmp

Filesize
568KB

Download