354b7ed28e969b5cb1492a033a887f9f1bf7c6795bc4ca38c65599b5ff09a7af

Analysis

max time kernel
7s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
04/07/2024, 19:38

Target

2603aed995f3bc6c719298276bb6d5fd_JaffaCakes118.dll
Size

218KB
MD5

2603aed995f3bc6c719298276bb6d5fd
SHA1

0e651786e817f06a0aab16ab2b73afd5fc80ff74
SHA256

354b7ed28e969b5cb1492a033a887f9f1bf7c6795bc4ca38c65599b5ff09a7af
SHA512

faa672c13c886ddadc9ddb6e0194917f7acf2426f583d64e3105d3936bf726f506d231bc0ee170899a914500483617dbc037b16dac9f8466a6042388a13d9c3c
SSDEEP

3072:lyvO7ifygWXk+QZEWPrnic2aZIBfiVBBhV+bGn7usUpYCF+MJACEiXMmT5VaauSD:lICH0JZEO7ic8f0YG7u3pnFXEi/wal

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3184	944	WerFault.exe	78

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2784 wrote to memory of 944	2784	rundll32.exe	78
PID 2784 wrote to memory of 944	2784	rundll32.exe	78
PID 2784 wrote to memory of 944	2784	rundll32.exe	78

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2603aed995f3bc6c719298276bb6d5fd_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2784
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2603aed995f3bc6c719298276bb6d5fd_JaffaCakes118.dll,#1
  2⤵
  PID:944
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 944 -s 620
    3⤵
    - Program crash
    PID:3184

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 944 -ip 944
1⤵
PID:2428

memory/944-0-0x0000000002CE0000-0x0000000002CF7000-memory.dmp

Filesize
92KB

Download