a70ee13a8adae0f07257dbc97b5b7788c75f8c21538c0cff61b6a256855905e3

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
04/07/2024, 03:55

Target

248b035ab016cb272dc58bb78f6244dc_JaffaCakes118.dll
Size

28KB
MD5

248b035ab016cb272dc58bb78f6244dc
SHA1

c0bc15430a2dfa21b521232dda88561cea883dbf
SHA256

a70ee13a8adae0f07257dbc97b5b7788c75f8c21538c0cff61b6a256855905e3
SHA512

f196499bf1c3f37d5da973f36cdf89cc93763ace60f45165b41595cd7ffa815e272a8fd39a29838c62827f6071128204cabb6af345cc4a78d715ad6cf3ece3d4
SSDEEP

768:6QZcnCKP4ych/rNKCGCsB1zkZ7O5IY4BA3:6QZQCKP45NKCrWkZq5Ic

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3056	1896	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4656 wrote to memory of 1896	4656	rundll32.exe	81
PID 4656 wrote to memory of 1896	4656	rundll32.exe	81
PID 4656 wrote to memory of 1896	4656	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\248b035ab016cb272dc58bb78f6244dc_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4656
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\248b035ab016cb272dc58bb78f6244dc_JaffaCakes118.dll,#1
  2⤵
  PID:1896
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1896 -s 544
    3⤵
    - Program crash
    PID:3056

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1896 -ip 1896
1⤵
PID:3516

memory/1896-0-0x0000000010000000-0x0000000010016000-memory.dmp

Filesize
88KB

Download