53242315e4df0ffc0de099ca12383e5594c3ea7cf4db77b626202bd29e234f30

Analysis

max time kernel
96s
max time network
98s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
28/06/2024, 05:52

Target

1905744fe7c46f22aef2bb6c25a70aba_JaffaCakes118.dll
Size

31KB
MD5

1905744fe7c46f22aef2bb6c25a70aba
SHA1

050438614c49ba98eeab2a2583c0d72c8d11128a
SHA256

53242315e4df0ffc0de099ca12383e5594c3ea7cf4db77b626202bd29e234f30
SHA512

b17b8619cc19060d9819e6b1a9e6ebebf4c29a66ee23a7d37e0adaab98954684e7dfef670dbcfa7bc94fe4bd43398e7c5080407ee260c6fbeebe79e450dbd562
SSDEEP

768:zYywROEtjoa6TAIDVYdWpzuHeGcRKk6Y1DHUJqxQS:zgEEtF6/wWpzuHDcokX1TUUH

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3732	2628	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4468 wrote to memory of 2628	4468	rundll32.exe	81
PID 4468 wrote to memory of 2628	4468	rundll32.exe	81
PID 4468 wrote to memory of 2628	4468	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1905744fe7c46f22aef2bb6c25a70aba_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4468
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1905744fe7c46f22aef2bb6c25a70aba_JaffaCakes118.dll,#1
  2⤵
  PID:2628
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2628 -s 544
    3⤵
    - Program crash
    PID:3732

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2628 -ip 2628
1⤵
PID:1916

memory/2628-0-0x0000000010000000-0x0000000010018000-memory.dmp

Filesize
96KB

Download