5e42abbb76d60af63fa4dd8a528f6f6bb925cbf1dc121a5133a01744cc91696c

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
01/07/2024, 08:40

Target

1aa38705192454b0258ac88daae7c2ed_JaffaCakes118.dll
Size

76KB
MD5

1aa38705192454b0258ac88daae7c2ed
SHA1

225dfc1be13c9d8e07defe0db83d117b470d0935
SHA256

5e42abbb76d60af63fa4dd8a528f6f6bb925cbf1dc121a5133a01744cc91696c
SHA512

9c055af50b3503b8fea8e755a27923f26b4a46ac1b1a9347ee86a2448a5040fddf78e178a51173f499a2587d304ffcaaef89050f1c3e782d6251e83f1f86c315
SSDEEP

768:Yhr/iEx7lLKF285qUNe/M0rxAqlbmd51S+yWBCFNF:+/iIEFVoHrOqo1S4BCP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3272	3456	WerFault.exe	80

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3584 wrote to memory of 3456	3584	rundll32.exe	80
PID 3584 wrote to memory of 3456	3584	rundll32.exe	80
PID 3584 wrote to memory of 3456	3584	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1aa38705192454b0258ac88daae7c2ed_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3584
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1aa38705192454b0258ac88daae7c2ed_JaffaCakes118.dll,#1
  2⤵
  PID:3456
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3456 -s 600
    3⤵
    - Program crash
    PID:3272

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 3456 -ip 3456
1⤵
PID:1136