a858d4ac2b427f8b0484145a6c5db5899092861f279b130443786bf5589559cd

Analysis

max time kernel
140s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
24/06/2024, 18:21

Target

0a199d510dc55de36f93f5d894555187_JaffaCakes118.dll
Size

174KB
MD5

0a199d510dc55de36f93f5d894555187
SHA1

eee8c34035a774c3583fcf165eb2067ba0c16e84
SHA256

a858d4ac2b427f8b0484145a6c5db5899092861f279b130443786bf5589559cd
SHA512

ad056d5e36fafc71f730a7d91a295a2165466050a818c1a739abeda429244a550c36f60d69b184e0e885a6c844c635495188fb2b0d088442be2b42cb3875b683
SSDEEP

3072:eIU+zsS3RYtVSHPNMUknMV575lEjE3KrdLwmoqqTej5mFrSRcOxciNj7jq2O79kD:RnS6HPNMUV5jGQKxLgbZSX2iNLEy

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1760	4920	WerFault.exe	84

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4920	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2500 wrote to memory of 4920	2500	rundll32.exe	84
PID 2500 wrote to memory of 4920	2500	rundll32.exe	84
PID 2500 wrote to memory of 4920	2500	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0a199d510dc55de36f93f5d894555187_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2500
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0a199d510dc55de36f93f5d894555187_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:4920
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4920 -s 608
    3⤵
    - Program crash
    PID:1760

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4920 -ip 4920
1⤵
PID:3164