b4ec9fb1ef3b36a88c0757682d36902d0f5b5e3fa159d3c7fbc19ad9fde493de

Analysis

max time kernel
93s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
04/07/2024, 06:32

Target

24f45ec3ab1f95b6047a44cbe13514a2_JaffaCakes118.dll
Size

13KB
MD5

24f45ec3ab1f95b6047a44cbe13514a2
SHA1

8fe774a0a22bd6c6cf8ff375ea929bb665518188
SHA256

b4ec9fb1ef3b36a88c0757682d36902d0f5b5e3fa159d3c7fbc19ad9fde493de
SHA512

e72900f867000a6e3707e31d2829133d2aca012a39ea39315776121db0b96ea6dab4617a5bbb8dcf7629596e85253baf5ebefd4ea215e707a9abaca0341cf818
SSDEEP

384:cDGaLDNc4q4yLYfuSfvX8WfhGs5VYpAmmtGxYcQFY:cCWZc4B4aP7cvpA8ecv

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1604	3908	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3152 wrote to memory of 3908	3152	rundll32.exe	81
PID 3152 wrote to memory of 3908	3152	rundll32.exe	81
PID 3152 wrote to memory of 3908	3152	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\24f45ec3ab1f95b6047a44cbe13514a2_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3152
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\24f45ec3ab1f95b6047a44cbe13514a2_JaffaCakes118.dll,#1
  2⤵
  PID:3908
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3908 -s 548
    3⤵
    - Program crash
    PID:1604

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3908 -ip 3908
1⤵
PID:4900