ab3ce568694aa23e5fce98087a3042ad8b60667291525590d333938f93c9075f

Analysis

max time kernel
93s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
06-07-2024 07:24

Target

27b75f80c8a3f6943b3c36b74efc0c7f_JaffaCakes118.dll
Size

113KB
MD5

27b75f80c8a3f6943b3c36b74efc0c7f
SHA1

db7a5027e1e099493f9661df938baee79dde57b1
SHA256

ab3ce568694aa23e5fce98087a3042ad8b60667291525590d333938f93c9075f
SHA512

b4ad919a356a8f15060b659b05fa071c21744f94b7239f6d450c68d80d867a13895207bd374b47d8b4be1c768c852b2bbadd05065c315ee9f991ff7e0360a1c4
SSDEEP

1536:V80tppULBnUo4TGhe7PrZKIwHDt77KFfilnX0UeAgyeky:HtsLBnUoFSdKnHpKPFfky

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3808	536	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1940 wrote to memory of 536	1940	rundll32.exe	82
PID 1940 wrote to memory of 536	1940	rundll32.exe	82
PID 1940 wrote to memory of 536	1940	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\27b75f80c8a3f6943b3c36b74efc0c7f_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1940
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\27b75f80c8a3f6943b3c36b74efc0c7f_JaffaCakes118.dll,#1
  2⤵
  PID:536
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 536 -s 560
    3⤵
    - Program crash
    PID:3808

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 536 -ip 536
1⤵
PID:2956

memory/536-0-0x00000000021D0000-0x00000000021F4000-memory.dmp

Filesize
144KB

Download