1882bd7f6503c73955949b6c09980ac45b2c5fcfd945c3545572a871f15da7d4

Analysis

max time kernel
94s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
06/07/2024, 07:37

Target

27c0b31dda54980b91553c12d451df90_JaffaCakes118.dll
Size

96KB
MD5

27c0b31dda54980b91553c12d451df90
SHA1

6481c58434f3f5520596ee1ad135d1cf36fffb4e
SHA256

1882bd7f6503c73955949b6c09980ac45b2c5fcfd945c3545572a871f15da7d4
SHA512

bcaf2fccee5e06558beaf880840a0e9e32d0b70bdc3ae65d83aea05747f5c2e4ff6b99cf87317e7b374339a6be004d4cd86f0506db96fa6a529ea6ff5a10cbf6
SSDEEP

1536:nmEgDV9y5GXvkGwd5shTcgD/XLG99P5ju7/a9Z9+C:nmEgDzB8bdUcgz74PFuDa9ZYC

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3820	4600	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3744 wrote to memory of 4600	3744	rundll32.exe	82
PID 3744 wrote to memory of 4600	3744	rundll32.exe	82
PID 3744 wrote to memory of 4600	3744	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\27c0b31dda54980b91553c12d451df90_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3744
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\27c0b31dda54980b91553c12d451df90_JaffaCakes118.dll,#1
  2⤵
  PID:4600
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4600 -s 672
    3⤵
    - Program crash
    PID:3820

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4600 -ip 4600
1⤵
PID:4764