e5d024366c5b04a47d2f6801d47cab67398290bb27cbf530aaafde71cd6f9650

Analysis

max time kernel
93s
max time network
131s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
27-06-2024 13:05

Target

161be61b2ec8d80dc4466900f585edf9_JaffaCakes118.dll
Size

66KB
MD5

161be61b2ec8d80dc4466900f585edf9
SHA1

7216a433e84f1f39699b63f9286c2ce25d36efcc
SHA256

e5d024366c5b04a47d2f6801d47cab67398290bb27cbf530aaafde71cd6f9650
SHA512

1dba65185cea576186294fb0b8fc59b5c8920d8eb50a4f231b740f7b5e2a1de93354e70404816590d8dd41c48542efc548cfa14d37e93c1ac152fb1361894169
SSDEEP

1536:0yfBOIoqQhhOr9/M7cW69Ue7kLt5bnZGcG+AK:/OIoqQhWqclkLnb9AK

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3268	1472	WerFault.exe	80

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1504 wrote to memory of 1472	1504	rundll32.exe	80
PID 1504 wrote to memory of 1472	1504	rundll32.exe	80
PID 1504 wrote to memory of 1472	1504	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\161be61b2ec8d80dc4466900f585edf9_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1504
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\161be61b2ec8d80dc4466900f585edf9_JaffaCakes118.dll,#1
  2⤵
  PID:1472
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1472 -s 620
    3⤵
    - Program crash
    PID:3268

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 1472 -ip 1472
1⤵
PID:4604

memory/1472-0-0x0000000000510000-0x0000000000529000-memory.dmp

Filesize
100KB

Download
memory/1472-1-0x0000000000510000-0x0000000000529000-memory.dmp

Filesize
100KB

Download