6158c4b8a2209729ffbb0c19a0153b56422b70f3a6534e09c947483ff033689e

Analysis

max time kernel
94s
max time network
103s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
04/07/2024, 19:01

Target

25e67aedda61e6805174ff993e9bb28e_JaffaCakes118.dll
Size

136KB
MD5

25e67aedda61e6805174ff993e9bb28e
SHA1

3a9b9618ef6d475a08da0312e8b701b85fff11fc
SHA256

6158c4b8a2209729ffbb0c19a0153b56422b70f3a6534e09c947483ff033689e
SHA512

39a0bdf199ecbc04c1f34fc3e1cfcef7e9c888a5d294c49bb402e9ed25df606c3769b4852365547537c2d2cad675bce7203390b48ef66e9d3b44154a2108618b
SSDEEP

1536:7oMRn26sAUzMK+U/7G5x4kHabAKAY3iQr/8XR89qViBDQhJoWQX3wk7:0MN26sAARv7Qx4nEZY3jrsWwGQHoZ

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4320	1288	WerFault.exe	78

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1368 wrote to memory of 1288	1368	rundll32.exe	78
PID 1368 wrote to memory of 1288	1368	rundll32.exe	78
PID 1368 wrote to memory of 1288	1368	rundll32.exe	78

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\25e67aedda61e6805174ff993e9bb28e_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1368
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\25e67aedda61e6805174ff993e9bb28e_JaffaCakes118.dll,#1
  2⤵
  PID:1288
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1288 -s 572
    3⤵
    - Program crash
    PID:4320

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1288 -ip 1288
1⤵
PID:4128