b29023717392c0b24753b756694e43e873ebe71d32c6b86e1a8fd262d48758e1

Analysis

max time kernel
131s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
27/06/2024, 20:54

Target

177cbb037d0a675ddcd3e707fc3a0810_JaffaCakes118.dll
Size

248KB
MD5

177cbb037d0a675ddcd3e707fc3a0810
SHA1

c78739d9e4420a5d4b7deca1be12377c593d30ab
SHA256

b29023717392c0b24753b756694e43e873ebe71d32c6b86e1a8fd262d48758e1
SHA512

717ad662242423b2162f98607abdf0f8122921b95ad42a0823af52bafe78f5f09cafb4d60edb8421b5f44636f346bfc01892470b7bbb5544265b1b6be0b32b38
SSDEEP

6144:0EMnUUUTGv/Dd5H/4WUYtdnQ3AoQeeaQeeQQeesQeerZQeehQeebNcBVZ8TVMIsq:ixx4WUYs2ceZn

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2244	5820	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4928 wrote to memory of 5820	4928	rundll32.exe	82
PID 4928 wrote to memory of 5820	4928	rundll32.exe	82
PID 4928 wrote to memory of 5820	4928	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\177cbb037d0a675ddcd3e707fc3a0810_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4928
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\177cbb037d0a675ddcd3e707fc3a0810_JaffaCakes118.dll,#1
  2⤵
  PID:5820
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5820 -s 824
    3⤵
    - Program crash
    PID:2244

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 5820 -ip 5820
1⤵
PID:4400