9df625b5204341f2cc8a0ea4ae5e4546fc09a61ad8bd88bf3c961b2971b41d29

Analysis

max time kernel
93s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
26/06/2024, 00:59

Target

102d66c75c74ac803940fe66dbe2fb9d_JaffaCakes118.dll
Size

24KB
MD5

102d66c75c74ac803940fe66dbe2fb9d
SHA1

3ee6504233919a721de3423f900bcb7e3c1f996e
SHA256

9df625b5204341f2cc8a0ea4ae5e4546fc09a61ad8bd88bf3c961b2971b41d29
SHA512

a46986316800d759bc2237e6d6569c42044eaf110364fe183a308d1163829f96b79bd886af771a63d8c62b981a210bd6bd18a2629f69ec444a8c492e411b59b8
SSDEEP

768:2L5Ia2446cnlL6xLuIBxgDdkfcmqJumUWPsY7:2LbI6c16BuaMdkGumUWPsY

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3016	3564	WerFault.exe	80

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 956 wrote to memory of 3564	956	rundll32.exe	80
PID 956 wrote to memory of 3564	956	rundll32.exe	80
PID 956 wrote to memory of 3564	956	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\102d66c75c74ac803940fe66dbe2fb9d_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:956
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\102d66c75c74ac803940fe66dbe2fb9d_JaffaCakes118.dll,#1
  2⤵
  PID:3564
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3564 -s 632
    3⤵
    - Program crash
    PID:3016

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3564 -ip 3564
1⤵
PID:1192

memory/3564-0-0x0000000010000000-0x000000001004E000-memory.dmp

Filesize
312KB

Download