3c81814eb6ae05e1f6634c0b7bf26f95f52dad446e1de718facf97bfa86ab767

Analysis

max time kernel
93s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
04-07-2024 22:45

Target

2681d2147471b88479d58f6c79066f16_JaffaCakes118.dll
Size

65KB
MD5

2681d2147471b88479d58f6c79066f16
SHA1

3bdd0c2d28418890eca2b4ca2394ac325e6b4b9e
SHA256

3c81814eb6ae05e1f6634c0b7bf26f95f52dad446e1de718facf97bfa86ab767
SHA512

a5bf98841bde36d216ebc5e28a016526093abe0860f267059948d592c3093c14aaafe714990dbd8c4f5a5959a3ffce3e40ddfa0d619a395fc1d4b39d6dd08b15
SSDEEP

1536:XyDcClW8TNg8TtbmIuZCcUyuhq1okCM2O8j7M8H/UAW3j+wekn:CgppAt5uZCcL4qg74oySwekn

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2716	4988	WerFault.exe	80

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2132 wrote to memory of 4988	2132	rundll32.exe	80
PID 2132 wrote to memory of 4988	2132	rundll32.exe	80
PID 2132 wrote to memory of 4988	2132	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2681d2147471b88479d58f6c79066f16_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2132
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2681d2147471b88479d58f6c79066f16_JaffaCakes118.dll,#1
  2⤵
  PID:4988
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4988 -s 584
    3⤵
    - Program crash
    PID:2716

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4988 -ip 4988
1⤵
PID:5108

memory/4988-0-0x0000000010000000-0x0000000010021000-memory.dmp

Filesize
132KB

Download
memory/4988-6-0x0000000010000000-0x0000000010021000-memory.dmp

Filesize
132KB

Download
memory/4988-2-0x0000000010000000-0x0000000010021000-memory.dmp

Filesize
132KB

Download
memory/4988-5-0x0000000010000000-0x0000000010021000-memory.dmp

Filesize
132KB

Download
memory/4988-7-0x000000001001B000-0x000000001001D000-memory.dmp

Filesize
8KB

Download
memory/4988-3-0x0000000010000000-0x0000000010021000-memory.dmp

Filesize
132KB

Download
memory/4988-4-0x0000000010000000-0x0000000010021000-memory.dmp

Filesize
132KB

Download
memory/4988-1-0x0000000010000000-0x0000000010021000-memory.dmp

Filesize
132KB

Download
memory/4988-9-0x0000000010000000-0x0000000010021000-memory.dmp

Filesize
132KB

Download