82715a824fdc38b92c46a68f49171e574a8a1553fb41ca7889bf0c2b0ec8977b

Analysis

max time kernel
139s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
25/06/2024, 20:09

Target

0f5e0d7f2e9efa4f1b0fa147d0e29c1f_JaffaCakes118.dll
Size

2KB
MD5

0f5e0d7f2e9efa4f1b0fa147d0e29c1f
SHA1

77cbfaa0ed5fb10791513f1cf2487137c495ce3d
SHA256

82715a824fdc38b92c46a68f49171e574a8a1553fb41ca7889bf0c2b0ec8977b
SHA512

eaf389b78e56f6a5c54f73079a63f134020aab4eb90dc2bd95a2c39ab750b4e95c30d194f907972b5a0dc66a6e2c7eda2409596fabea00e53818aec3c3c4acf1

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4552	4416	WerFault.exe	85

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4564 wrote to memory of 4416	4564	rundll32.exe	85
PID 4564 wrote to memory of 4416	4564	rundll32.exe	85
PID 4564 wrote to memory of 4416	4564	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0f5e0d7f2e9efa4f1b0fa147d0e29c1f_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4564
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0f5e0d7f2e9efa4f1b0fa147d0e29c1f_JaffaCakes118.dll,#1
  2⤵
  PID:4416
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4416 -s 544
    3⤵
    - Program crash
    PID:4552

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4416 -ip 4416
1⤵
PID:736

memory/4416-0-0x0000000010000000-0x0000000010004000-memory.dmp

Filesize
16KB

Download