1dd74c0ee4bcaa91d09f0b36e664de69b5263e58f95180231d0769d40a4d62f3

Analysis

max time kernel
150s
max time network
132s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
25/06/2024, 15:26

Target

0e931c8510ea8d6abc9531d069ba3940_JaffaCakes118.dll
Size

40KB
MD5

0e931c8510ea8d6abc9531d069ba3940
SHA1

e93545f5d39e2dac35d58792e03de3198153a5b5
SHA256

1dd74c0ee4bcaa91d09f0b36e664de69b5263e58f95180231d0769d40a4d62f3
SHA512

e0eabe4997f15ef45bdf99a897d22900b1e55097cbcfe1100725d613263670b657ffcf8c0d1cd9960eab12e5b7c4bddb3441c279ebeb5e2ca5562d5503c6098a
SSDEEP

768:HHrrhnYXUk+JTuvtRHMQ4RRDyDEl0QgsxsY2D74TN5gIRstnJTE215wa+niNT/5d:nrNK+0vtRHt4oElOsxsY2H6NhwAiwxnQ

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2712	1136	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3308 wrote to memory of 1136	3308	rundll32.exe	83
PID 3308 wrote to memory of 1136	3308	rundll32.exe	83
PID 3308 wrote to memory of 1136	3308	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0e931c8510ea8d6abc9531d069ba3940_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3308
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0e931c8510ea8d6abc9531d069ba3940_JaffaCakes118.dll,#1
  2⤵
  PID:1136
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1136 -s 548
    3⤵
    - Program crash
    PID:2712

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1136 -ip 1136
1⤵
PID:2652

memory/1136-0-0x0000000010000000-0x0000000010023000-memory.dmp

Filesize
140KB

Download