98739bea6c6576f7638ede7a9752a9255352ef707cae112ff6df55edc2b768ae

Analysis

max time kernel
132s
max time network
133s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
28-06-2024 14:08

Target

1a6b87c2422d338346c33b2c237223c2_JaffaCakes118.dll
Size

9KB
MD5

1a6b87c2422d338346c33b2c237223c2
SHA1

8d8643ee2a3089afeb6fa5df6be55c572b7139c7
SHA256

98739bea6c6576f7638ede7a9752a9255352ef707cae112ff6df55edc2b768ae
SHA512

7cd282107c3b720c0c1ededef9774a303738d8c85480cfe9b78e0ae023c655aac51a832a356cbe9c97c89bc09265290ccc90226506bbb0bc36e382dd227ab480
SSDEEP

96:q1V7dR7uwEU+hCT3GrxZ4MUtPNlz0MdG8EWvdM3IWwG34bK:kuwEt8rsTUtPLzKNWSYWF4b

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5088	4600	WerFault.exe	88

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2024 wrote to memory of 4600	2024	rundll32.exe	88
PID 2024 wrote to memory of 4600	2024	rundll32.exe	88
PID 2024 wrote to memory of 4600	2024	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1a6b87c2422d338346c33b2c237223c2_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2024
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1a6b87c2422d338346c33b2c237223c2_JaffaCakes118.dll,#1
  2⤵
  PID:4600
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4600 -s 624
    3⤵
    - Program crash
    PID:5088

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4600 -ip 4600
1⤵
PID:1852

memory/4600-0-0x00000000012A0000-0x00000000012A7000-memory.dmp

Filesize
28KB

Download