d9deea4fd4d946df73eaf3792633432fb6ceb8b73364580b00681c95aa0c2590

Analysis

max time kernel
147s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03-07-2024 04:22

Target

21105ed415dfd65be6a21a68afc312d1_JaffaCakes118.dll
Size

274KB
MD5

21105ed415dfd65be6a21a68afc312d1
SHA1

924bbb44b32d3d409c4f739b6911b87fca296571
SHA256

d9deea4fd4d946df73eaf3792633432fb6ceb8b73364580b00681c95aa0c2590
SHA512

a7ade43ec46cb80bc2a2f2446e4c0f94b634027e69f8964ac43726079c3de649062a8100833a3afab836860d86cac9c7295a0876068d2f015b18a28aed3ffc55
SSDEEP

6144:IOSjIXo9jPDv5eisvDs8W7s9ZuJrUO//oOqzTzlUK/zNFe5kQn:3549zDUis7s8W7GYAOqWAMiQ

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1688	1016	WerFault.exe	80

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5100 wrote to memory of 1016	5100	rundll32.exe	80
PID 5100 wrote to memory of 1016	5100	rundll32.exe	80
PID 5100 wrote to memory of 1016	5100	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\21105ed415dfd65be6a21a68afc312d1_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5100
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\21105ed415dfd65be6a21a68afc312d1_JaffaCakes118.dll,#1
  2⤵
  PID:1016
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1016 -s 588
    3⤵
    - Program crash
    PID:1688

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1016 -ip 1016
1⤵
PID:2280

memory/1016-0-0x00000000736D0000-0x000000007371C000-memory.dmp

Filesize
304KB

Download
memory/1016-1-0x00000000736D0000-0x000000007371C000-memory.dmp

Filesize
304KB

Download