4c24699b338bc67c246e54edf7ef40a90ea8f46229d118f83b04d631517de656

Analysis

max time kernel
147s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
27/06/2024, 09:05

Target

156ceeddd631a711eca196543dddc328_JaffaCakes118.dll
Size

78KB
MD5

156ceeddd631a711eca196543dddc328
SHA1

0608f0b32bc0187e88a013c96cc4b015b806b925
SHA256

4c24699b338bc67c246e54edf7ef40a90ea8f46229d118f83b04d631517de656
SHA512

14b0bbd3b0d509c52b1bfaf4136dc0c066dce44f053f248a733191c40bc94a3e0684c40dbb5088216c5f3b105543515da260446e4b3f83afa4cc0000ae1a8f44
SSDEEP

1536:3ww+54ym8YnLuHRrXPkAqRSUrXvRYHY6Zc0HaTC0iTp1sT6EZErPGzhIWpVytl:84UxX9qJ94f7Tp1m6FPCIUg

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1072	3116	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 380 wrote to memory of 3116	380	rundll32.exe	81
PID 380 wrote to memory of 3116	380	rundll32.exe	81
PID 380 wrote to memory of 3116	380	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\156ceeddd631a711eca196543dddc328_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:380
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\156ceeddd631a711eca196543dddc328_JaffaCakes118.dll,#1
  2⤵
  PID:3116
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3116 -s 596
    3⤵
    - Program crash
    PID:1072

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3116 -ip 3116
1⤵
PID:1536

memory/3116-0-0x0000000010000000-0x0000000010027000-memory.dmp

Filesize
156KB

Download