25ea0ccd22727afd32e42c4f265c4f0d37c6b1aa62ac93b16e43a8f81da63ee0

Analysis

max time kernel
149s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
01/07/2024, 07:59

Target

1a85c7ee37e30785b04d7f80b975302b_JaffaCakes118.dll
Size

16KB
MD5

1a85c7ee37e30785b04d7f80b975302b
SHA1

f75d9768058f80adecf50be3d806dc8613e60d9f
SHA256

25ea0ccd22727afd32e42c4f265c4f0d37c6b1aa62ac93b16e43a8f81da63ee0
SHA512

77c74034349e343e8de00950adec3b753faf80202ca9c4a12e9ce30c5a02bf36b02c4331a66aed9056df8b27a2147a3e32ac1a0a0fb3faee2d575c997f98f461
SSDEEP

384:vWwXvOow297UixaRCjnmin/tw4Hmvhg5PRi:vDOoxUixacjnh/twqmveLi

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1428	2404	WerFault.exe	80

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1436 wrote to memory of 2404	1436	rundll32.exe	80
PID 1436 wrote to memory of 2404	1436	rundll32.exe	80
PID 1436 wrote to memory of 2404	1436	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1a85c7ee37e30785b04d7f80b975302b_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1436
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1a85c7ee37e30785b04d7f80b975302b_JaffaCakes118.dll,#1
  2⤵
  PID:2404
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2404 -s 600
    3⤵
    - Program crash
    PID:1428

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 2404 -ip 2404
1⤵
PID:1808

memory/2404-0-0x0000000010000000-0x0000000010010000-memory.dmp

Filesize
64KB

Download