08dd0c2db0ce15ed4feadcf5ce01412e7eded6c7b66afa565e92d567374b0252

Analysis

max time kernel
41s
max time network
51s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03/07/2024, 23:57

Target

23ecbbb2141c474c0bb0f061a149b46b_JaffaCakes118.dll
Size

109KB
MD5

23ecbbb2141c474c0bb0f061a149b46b
SHA1

c902e2d3e7fe3527c98a2975fbacc8218b5756c9
SHA256

08dd0c2db0ce15ed4feadcf5ce01412e7eded6c7b66afa565e92d567374b0252
SHA512

26959de0d587e78e96d3c24207f83f7fbb7d6877355e6207fd2e9520fbd8a4d1f48541d9498bb161f787f21ff9b219f109027631a24a972586125689d877d8fb
SSDEEP

1536:EpF0L5+uxcbd51Q3ELQqYcsDrfcDUnjiEliRJxVymQS7yvx9Cx:SF0Aj1QsQqY/D7cDUjZlYJxVyjS7yJAx

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3164	4656	WerFault.exe	80

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3992 wrote to memory of 4656	3992	rundll32.exe	80
PID 3992 wrote to memory of 4656	3992	rundll32.exe	80
PID 3992 wrote to memory of 4656	3992	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\23ecbbb2141c474c0bb0f061a149b46b_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3992
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\23ecbbb2141c474c0bb0f061a149b46b_JaffaCakes118.dll,#1
  2⤵
  PID:4656
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4656 -s 676
    3⤵
    - Program crash
    PID:3164

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4656 -ip 4656
1⤵
PID:1384