31997c2b27431e754a8953bca2545f15ebe9a90b319272f5b25afa9df99ababd

Analysis

max time kernel
147s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
04/07/2024, 02:51

Target

246129e837965a6b8f3dd843983f3a45_JaffaCakes118.dll
Size

126KB
MD5

246129e837965a6b8f3dd843983f3a45
SHA1

97cef854d83514bfb2450bc3f352f5d410792dcf
SHA256

31997c2b27431e754a8953bca2545f15ebe9a90b319272f5b25afa9df99ababd
SHA512

e49f5024a3cedb1367c81b2b16abdc54fec2e2adeaaab5c195f438959b980960b64e746e7a305be2718c669db8026775db1b564eb751dde754252b041f852538
SSDEEP

3072:oLWxkx+M+g6ZK4BjG8cBxR/Rk0sK2qLkNvHa7q:27x+u6ZX1Cq0slqANvHYq

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3088	4196	WerFault.exe	80

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3848 wrote to memory of 4196	3848	rundll32.exe	80
PID 3848 wrote to memory of 4196	3848	rundll32.exe	80
PID 3848 wrote to memory of 4196	3848	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\246129e837965a6b8f3dd843983f3a45_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3848
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\246129e837965a6b8f3dd843983f3a45_JaffaCakes118.dll,#1
  2⤵
  PID:4196
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4196 -s 580
    3⤵
    - Program crash
    PID:3088

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4196 -ip 4196
1⤵
PID:4004

memory/4196-0-0x0000000010000000-0x0000000010041000-memory.dmp

Filesize
260KB

Download