54ff65cff262c7fdb68b42e3690e6e6f986b48c7a2c9ce1866aef70b52a331a6

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
03/07/2024, 07:35

Target

218d9f2cd78ca72ea7ed0ffe9e2dc67d_JaffaCakes118.dll
Size

201KB
MD5

218d9f2cd78ca72ea7ed0ffe9e2dc67d
SHA1

1142b3cf347e439eae6d0c90b6cde9797fed8e44
SHA256

54ff65cff262c7fdb68b42e3690e6e6f986b48c7a2c9ce1866aef70b52a331a6
SHA512

14372024fc3c71b9ceff52c847cf0867901b4a92098c6340367e12e0fa1df1f0119b339d2643eebb05630e599727584864ff2281b3ed2ec69085fa89ef76f8d2
SSDEEP

3072:nTRVnCuFuZUPj5QFpTF7RH+H21liYmrn70E8k/srsfhSWIDQDSIU3K:nTHCeGUPsr7Bc22Y+798k/Es2kT

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3556	2868	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 924 wrote to memory of 2868	924	rundll32.exe	83
PID 924 wrote to memory of 2868	924	rundll32.exe	83
PID 924 wrote to memory of 2868	924	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\218d9f2cd78ca72ea7ed0ffe9e2dc67d_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:924
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\218d9f2cd78ca72ea7ed0ffe9e2dc67d_JaffaCakes118.dll,#1
  2⤵
  PID:2868
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2868 -s 620
    3⤵
    - Program crash
    PID:3556

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2868 -ip 2868
1⤵
PID:4140

memory/2868-0-0x00000000028A0000-0x00000000028BD000-memory.dmp

Filesize
116KB

Download