e96b106232d8ce05b3fe00c1a5b353935ccdbfacb365e6c899dd95137554279e

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
04/07/2024, 00:22

Target

23fed378e2979e4d83d9d4c8504ea692_JaffaCakes118.dll
Size

78KB
MD5

23fed378e2979e4d83d9d4c8504ea692
SHA1

fbe74696f971f26acd90b59d4b24bac0a5443ca3
SHA256

e96b106232d8ce05b3fe00c1a5b353935ccdbfacb365e6c899dd95137554279e
SHA512

e112fd007dd9ba084c39193d9ec32cff20e03c25aa55c4be70bfff7548b673b9b8ef31caeeb0c548acdd6d6026fdf482dee3d7c4a19a34c2baf8d8b20b7e67b0
SSDEEP

1536:0Dpp+eG2YywRBJu80dAA3u0SOVbERd1oGrCJzvr1JJ6/My4vnPGW:WpZG2YyJdAA3u04Rd1xWJLrXJNh/b

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1004	1080	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2540 wrote to memory of 1080	2540	rundll32.exe	81
PID 2540 wrote to memory of 1080	2540	rundll32.exe	81
PID 2540 wrote to memory of 1080	2540	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\23fed378e2979e4d83d9d4c8504ea692_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2540
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\23fed378e2979e4d83d9d4c8504ea692_JaffaCakes118.dll,#1
  2⤵
  PID:1080
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1080 -s 580
    3⤵
    - Program crash
    PID:1004

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1080 -ip 1080
1⤵
PID:2644

memory/1080-0-0x0000000010000000-0x0000000010027000-memory.dmp

Filesize
156KB

Download