9870900d92c80afb088ba9bafdf96f55f16017adeb4b3cdbfd18d484288362fd

Analysis

max time kernel
147s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
25/06/2024, 17:59

Target

0f02b916530727976efbd52a000255d4_JaffaCakes118.dll
Size

737KB
MD5

0f02b916530727976efbd52a000255d4
SHA1

a55376d3d5e29092805b48741ecb73a4040ab6b3
SHA256

9870900d92c80afb088ba9bafdf96f55f16017adeb4b3cdbfd18d484288362fd
SHA512

2d65e034929f90b41641639503449731c231cdf9e2bb098cb584ab17ba19d30a770cc8af2319143e246a6aee8f43ae5cdadf19a2d129cb8aee4a68c1b1e692d8
SSDEEP

12288:Cu6iSe70DWSFAID02lbnkhF5dtSWD4t2F1sDw0P2NtCEodvWs6N7WSsoZJcw:Cu6iveW1ID0cDkhFftrD2xZMCEodvt6V

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1360	3116	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 380 wrote to memory of 3116	380	rundll32.exe	81
PID 380 wrote to memory of 3116	380	rundll32.exe	81
PID 380 wrote to memory of 3116	380	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0f02b916530727976efbd52a000255d4_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:380
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0f02b916530727976efbd52a000255d4_JaffaCakes118.dll,#1
  2⤵
  PID:3116
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3116 -s 544
    3⤵
    - Program crash
    PID:1360

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3116 -ip 3116
1⤵
PID:4676