8b70ebd1458e49c6f52d76e028ac572e3ebccf0cfe6ac740432d554ab0c43074

Analysis

max time kernel
47s
max time network
56s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
04/07/2024, 23:44

Target

26ad156fd19170174514f26c22c0b203_JaffaCakes118.dll
Size

86KB
MD5

26ad156fd19170174514f26c22c0b203
SHA1

6d4206ae0f87dda2817d4c82e22635584e2548a2
SHA256

8b70ebd1458e49c6f52d76e028ac572e3ebccf0cfe6ac740432d554ab0c43074
SHA512

73745e8f309c8ac4c4205991b38df83905e6b90c1830b7fcc5a2b88c2e0644247f4318780938b2f3924599d437760d357c5ecd4c382772fd65e422a02392427f
SSDEEP

1536:GQCxl5IwWl16C7n4P1U0HVFGUH0JUXD8FCfczFwhYSzo2xW:mBEnuD0JUz84fcBtKoh

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4788	464	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1080 wrote to memory of 464	1080	rundll32.exe	83
PID 1080 wrote to memory of 464	1080	rundll32.exe	83
PID 1080 wrote to memory of 464	1080	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\26ad156fd19170174514f26c22c0b203_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1080
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\26ad156fd19170174514f26c22c0b203_JaffaCakes118.dll,#1
  2⤵
  PID:464
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 464 -s 544
    3⤵
    - Program crash
    PID:4788

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 464 -ip 464
1⤵
PID:1164

memory/464-0-0x0000000010000000-0x000000001008D000-memory.dmp

Filesize
564KB

Download