5d9e84ba8e44313fcf147b309a14b014363aa9963c3b0331f3e36dbef378375d

Analysis

max time kernel
93s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
28/06/2024, 06:47

Target

192ba75b577e872233aa4d0a8b7be597_JaffaCakes118.dll
Size

31KB
MD5

192ba75b577e872233aa4d0a8b7be597
SHA1

fb0369e2289a5c6892b134765d65d75e7aca945c
SHA256

5d9e84ba8e44313fcf147b309a14b014363aa9963c3b0331f3e36dbef378375d
SHA512

15ea3b2108356f72b13887c1c383f7dcb2e658cefa4150c9bb23fbd45aad1442e9cf17b1d6b39436a2edd87d5834e61f18845a051df9cd4f641399f3a7006ef2
SSDEEP

768:nVhi0P/A5a6pnYnV5xtxB2oaADIhOzFnd28:nVhjPIZpOB2oDDIhMVd

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4736	1492	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4824 wrote to memory of 1492	4824	rundll32.exe	81
PID 4824 wrote to memory of 1492	4824	rundll32.exe	81
PID 4824 wrote to memory of 1492	4824	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\192ba75b577e872233aa4d0a8b7be597_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4824
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\192ba75b577e872233aa4d0a8b7be597_JaffaCakes118.dll,#1
  2⤵
  PID:1492
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1492 -s 544
    3⤵
    - Program crash
    PID:4736

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1492 -ip 1492
1⤵
PID:4728

memory/1492-0-0x0000000010000000-0x0000000010018000-memory.dmp

Filesize
96KB

Download