645e0b1b0a6d81dd50e2b9dcc1060b5ca2800dc5d0aeee4730e6dcfa007d14f4

Analysis

max time kernel
53s
max time network
66s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
04/07/2024, 21:39

Target

264e4ca01501367af2c9e9d9df1982b8_JaffaCakes118.dll
Size

204KB
MD5

264e4ca01501367af2c9e9d9df1982b8
SHA1

8ead329b5c4ddd049ae975b7e5e3913072c2fd10
SHA256

645e0b1b0a6d81dd50e2b9dcc1060b5ca2800dc5d0aeee4730e6dcfa007d14f4
SHA512

00886b84c771d102895a727ec078c9248689ce98ad8cba3d5a9b432454bbf999485034e6f4aba7c18cc0f567eee32730e5b01c85ddae1e0d908bb76f76e3c754
SSDEEP

3072:thlJ/hn7LWnPIdyDIRbB+oDpJR9b5ivrVnfVHSfcIRwbmw0qHxcO5VH66mAX6gAQ:FXoIDHYrCQFX6gARBA

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
5020	3956	WerFault.exe	80
1804	3956	WerFault.exe	80

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4704 wrote to memory of 3956	4704	rundll32.exe	80
PID 4704 wrote to memory of 3956	4704	rundll32.exe	80
PID 4704 wrote to memory of 3956	4704	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\264e4ca01501367af2c9e9d9df1982b8_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4704
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\264e4ca01501367af2c9e9d9df1982b8_JaffaCakes118.dll,#1
  2⤵
  PID:3956
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3956 -s 592
    3⤵
    - Program crash
    PID:5020
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3956 -s 832
    3⤵
    - Program crash
    PID:1804

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3956 -ip 3956
1⤵
PID:3724

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 3956 -ip 3956
1⤵
PID:2008