36dd1171e3dd59d464a8b1bc4b16b0931d0184f019bbf7c840b1917abe0fafee

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
27/06/2024, 11:23

Target

15d18596e7ef2b5e7a4dc2baa143dd7d_JaffaCakes118.dll
Size

15KB
MD5

15d18596e7ef2b5e7a4dc2baa143dd7d
SHA1

50ee8d7715058e564026489e87156a316171edf4
SHA256

36dd1171e3dd59d464a8b1bc4b16b0931d0184f019bbf7c840b1917abe0fafee
SHA512

325e899db5d0b953b4e7ccdfcf3fc17f947b83f6ea81b8250962af55ce0a998835d3f9168439520b9da3c88c56c63ffb8e9435febeb9422de79ef35651666587
SSDEEP

384:oeIMSuDmsJ99NM0XyEL0zmrb38/L/xdQgHA:xIMv9NPLL0zm38LACA

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
116	1044	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4968 wrote to memory of 1044	4968	rundll32.exe	81
PID 4968 wrote to memory of 1044	4968	rundll32.exe	81
PID 4968 wrote to memory of 1044	4968	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\15d18596e7ef2b5e7a4dc2baa143dd7d_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4968
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\15d18596e7ef2b5e7a4dc2baa143dd7d_JaffaCakes118.dll,#1
  2⤵
  PID:1044
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1044 -s 580
    3⤵
    - Program crash
    PID:116

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 1044 -ip 1044
1⤵
PID:3012

memory/1044-0-0x0000000000800000-0x0000000000810000-memory.dmp

Filesize
64KB

Download
memory/1044-1-0x0000000001320000-0x000000000132A000-memory.dmp

Filesize
40KB

Download