5df350657eedcff52b60a9aa497fa19cffefe140b54ba9b23fa299111fdbf1fe

Analysis

max time kernel
139s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
25-06-2024 20:16

Target

0f61ca8106f401101ef017bd831372f8_JaffaCakes118.dll
Size

292KB
MD5

0f61ca8106f401101ef017bd831372f8
SHA1

4bed4d81cb96041910ce33964df18b8b28779e08
SHA256

5df350657eedcff52b60a9aa497fa19cffefe140b54ba9b23fa299111fdbf1fe
SHA512

efccf0e5821cded5f9c9adea1692f0196204e6eacf57fd4425cf966a7a73e6ac6e94ac8d05003132331edaa331371c96bf0c387e4932a9624fc8c7889b12a8b9
SSDEEP

6144:V0D3yTjQbErlrUJV6RhxNQBDOi5uHStL6XZW8b:GD3Kj5rlaIRqwHStLEIW

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
3964	rundll32mgr.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\rundll32mgr.exe	rundll32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3152	3964	WerFault.exe	83

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3628 wrote to memory of 1728	3628	rundll32.exe	82
PID 3628 wrote to memory of 1728	3628	rundll32.exe	82
PID 3628 wrote to memory of 1728	3628	rundll32.exe	82
PID 1728 wrote to memory of 3964	1728	rundll32.exe	83
PID 1728 wrote to memory of 3964	1728	rundll32.exe	83
PID 1728 wrote to memory of 3964	1728	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0f61ca8106f401101ef017bd831372f8_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3628
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0f61ca8106f401101ef017bd831372f8_JaffaCakes118.dll,#1
  2⤵
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:1728
- - C:\Windows\SysWOW64\rundll32mgr.exe
    C:\Windows\SysWOW64\rundll32mgr.exe
    3⤵
    - Executes dropped EXE
    PID:3964
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3964 -s 424
      4⤵
      Program crash
      PID:3152

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3964 -ip 3964
1⤵
PID:4008

C:\Windows\SysWOW64\rundll32mgr.exe

Filesize
160KB

MD5
51a7b8e6dde65bdc6db16675e8e4efb2

SHA1
04be1eef924fe57a3a2f9a93dd1458283366242f

SHA256
a9c5a28460510e5a620bb2683361b899928730b34534e5774c0221081c15d4ce

SHA512
ee7fcc988ae337548e04595f574f1c68d3f2e80020d4e7be6a9dea967ad18f3262c8eced03e6ee914d248e4a51e58190ad9a761f7ad97dda7aee8531511306e2

Download Submit
memory/1728-1-0x0000000010000000-0x000000001004A000-memory.dmp

Filesize
296KB

Download