4cb5b15bc5ae1e574b745c28346eff7a5bcc35a269955bc97f283865b89312d1

Analysis

max time kernel
51s
max time network
51s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
24-06-2024 17:02

Target

09bf901341b4999c29af2b3ef9416763_JaffaCakes118.dll
Size

47KB
MD5

09bf901341b4999c29af2b3ef9416763
SHA1

9c13797f936e75ae9ba3044f656c0e6fc666a271
SHA256

4cb5b15bc5ae1e574b745c28346eff7a5bcc35a269955bc97f283865b89312d1
SHA512

b2e5467b94f243afb9c9cfe85d9e270c49591d36dd85ae68bbbda30de715f15f35de78e0584855f5535d11269c74b8312a0052722075caee4e0f09ce17c0f303
SSDEEP

768:fvLBz7DYMlViXuaqGssAAZsdGZ33NEy1BQ8aHsDv55IoNFw9ah9x3eQ6bnv84GQ:3Lh7DDlVLCLZSu39EyrcsDv0oNFH2pGQ

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
924	1020	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2828 wrote to memory of 1020	2828	rundll32.exe	81
PID 2828 wrote to memory of 1020	2828	rundll32.exe	81
PID 2828 wrote to memory of 1020	2828	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\09bf901341b4999c29af2b3ef9416763_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2828
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\09bf901341b4999c29af2b3ef9416763_JaffaCakes118.dll,#1
  2⤵
  PID:1020
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1020 -s 596
    3⤵
    - Program crash
    PID:924

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1020 -ip 1020
1⤵
PID:2772

memory/1020-0-0x0000000010000000-0x0000000010021000-memory.dmp

Filesize
132KB

Download