54d9a0f959f316873b275ff2ed5596f7ee5af432f4320adb13662d581e9ac262

Analysis

max time kernel
93s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
27/06/2024, 06:17

Target

14f6aa1d8eca12008f3d0adf2953361d_JaffaCakes118.dll
Size

88KB
MD5

14f6aa1d8eca12008f3d0adf2953361d
SHA1

7401d336979eb3611640edaf416151f74841d285
SHA256

54d9a0f959f316873b275ff2ed5596f7ee5af432f4320adb13662d581e9ac262
SHA512

31a93cebb5e9dc6c9c100d89e6a4ba613045afaed0119cfdbf062197f02bbeaef12fd74f679300f8ec18a883eec43f37a5e121e297df50a9e590b1d1d255ba2b
SSDEEP

1536:x3ETstzWmNGYsDW6oH4/s91CnhQ7XTZdN+LVtwVmdJl9Ygmo/HhzvVrh5I:j3BsDOzKnC7jZangS9YkHhzpP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1344	2472	WerFault.exe	80

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2472	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2472	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2536 wrote to memory of 2472	2536	rundll32.exe	80
PID 2536 wrote to memory of 2472	2536	rundll32.exe	80
PID 2536 wrote to memory of 2472	2536	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\14f6aa1d8eca12008f3d0adf2953361d_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2536
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\14f6aa1d8eca12008f3d0adf2953361d_JaffaCakes118.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  PID:2472
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2472 -s 624
    3⤵
    - Program crash
    PID:1344

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 2472 -ip 2472
1⤵
PID:3576

memory/2472-0-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/2472-1-0x0000000000420000-0x0000000000434000-memory.dmp

Filesize
80KB

Download
memory/2472-3-0x0000000000404000-0x0000000000405000-memory.dmp

Filesize
4KB

Download
memory/2472-4-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/2472-2-0x0000000000420000-0x0000000000434000-memory.dmp

Filesize
80KB

Download