d14f61b6089047fd4b82233537658e65c0e0c3a8746119934b50b0f57332ae94

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
27/06/2024, 07:11

Target

151b2b85d8cca1b7833843419f80a674_JaffaCakes118.dll
Size

72KB
MD5

151b2b85d8cca1b7833843419f80a674
SHA1

e479878d853e8632efc1722b63c5ef5795754727
SHA256

d14f61b6089047fd4b82233537658e65c0e0c3a8746119934b50b0f57332ae94
SHA512

2c581846453fc6d3e70339dd05b30daf7571eaa407e95f2d9e4d4a5c67283e355416e4e0cb802576c6ee46513b80e39d4b081b2307cb8a179c4db699ae579d6e
SSDEEP

1536:Sjjl3nwzSuOqBubw/WgT6zMKAOK2lCWcQajhRuv:C5UOq0ukgOK2l7aFQv

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3312	2692	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 412 wrote to memory of 2692	412	rundll32.exe	83
PID 412 wrote to memory of 2692	412	rundll32.exe	83
PID 412 wrote to memory of 2692	412	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\151b2b85d8cca1b7833843419f80a674_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:412
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\151b2b85d8cca1b7833843419f80a674_JaffaCakes118.dll,#1
  2⤵
  PID:2692
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2692 -s 600
    3⤵
    - Program crash
    PID:3312

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 2692 -ip 2692
1⤵
PID:2224