1d67178bfc085277b40d7621e5d8386ec12f82be94c29564ba4a0ae66e501695

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
04/07/2024, 04:56

Target

24b3a21d8bc8f671cead9e2b5ea65d13_JaffaCakes118.dll
Size

393KB
MD5

24b3a21d8bc8f671cead9e2b5ea65d13
SHA1

88fa46ada24e83fa7ca1677b4e40c15845169958
SHA256

1d67178bfc085277b40d7621e5d8386ec12f82be94c29564ba4a0ae66e501695
SHA512

cd97b791ea866683e6bf584fc08ee8fff2bbba492eaf5fdc306c3a748bd67f41bc5084ba5367d83204c9e342acf4b5fba5e227e76f6d0a02cfbdb668c52b6db6
SSDEEP

6144:s5VW+nK2DbcOyuzCCTA8np8SeQsajimSh6wj7lM:yyu+J7lM

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2800	4468	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2668 wrote to memory of 4468	2668	rundll32.exe	83
PID 2668 wrote to memory of 4468	2668	rundll32.exe	83
PID 2668 wrote to memory of 4468	2668	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\24b3a21d8bc8f671cead9e2b5ea65d13_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2668
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\24b3a21d8bc8f671cead9e2b5ea65d13_JaffaCakes118.dll,#1
  2⤵
  PID:4468
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4468 -s 560
    3⤵
    - Program crash
    PID:2800

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4468 -ip 4468
1⤵
PID:1648