f9b88defe7fa825eadd2e4c8503bf172158ff5dd41c9a19a9ac5fee4cc19b66e

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
28/06/2024, 08:18

Target

196d05660e5cbe352220b39e38bf00c8_JaffaCakes118.dll
Size

144KB
MD5

196d05660e5cbe352220b39e38bf00c8
SHA1

6850760cdb6a9f206b4d0909157e64fa518fc662
SHA256

f9b88defe7fa825eadd2e4c8503bf172158ff5dd41c9a19a9ac5fee4cc19b66e
SHA512

67defed46a5e89401f8298816e7d39e1e30a0f845004ca6c7f11e0c34f237fccd60ba1768827f33bcfda44b907e8fbb3672b6c5b9c45fc6935e15c4932a5007c
SSDEEP

3072:ZDf8Z9Uq7Vyfv8c+ZOwLLNo2p+O2fJyEiji8lOZ9tI:xeU9GOeBo2ENxyEaIZ

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2792	4064	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5068 wrote to memory of 4064	5068	rundll32.exe	82
PID 5068 wrote to memory of 4064	5068	rundll32.exe	82
PID 5068 wrote to memory of 4064	5068	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\196d05660e5cbe352220b39e38bf00c8_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5068
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\196d05660e5cbe352220b39e38bf00c8_JaffaCakes118.dll,#1
  2⤵
  PID:4064
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4064 -s 608
    3⤵
    - Program crash
    PID:2792

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4064 -ip 4064
1⤵
PID:5112

memory/4064-0-0x0000000010000000-0x0000000010067000-memory.dmp

Filesize
412KB

Download