e34bc442d9abdda7ec3e5b6e172a050f8beeddf8b097a4b6f40e914286563733

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
06-07-2024 15:12

Target

289d4cd3b760ada40c313148c2f4c7e4_JaffaCakes118.dll
Size

39KB
MD5

289d4cd3b760ada40c313148c2f4c7e4
SHA1

d112719c8ef1003a37db5c2cee69694eb848f7bb
SHA256

e34bc442d9abdda7ec3e5b6e172a050f8beeddf8b097a4b6f40e914286563733
SHA512

5a53f841aff1ea1221db6b6867d3c9d53116f59313e7b7a89aaea8aa7ab83c3cdc99dce2659ae3884e4992d128feea42b725cde851ce1175be14a999561a43f1
SSDEEP

768:TJRjcTrlNoobbTBsXLJjSBmKInOEBE2+xedSu5Tuh1nKcAW4Po9Sy:NR8lNoobblsXLJjiretyvI8u5TuhhIWH

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3760	3736	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1052 wrote to memory of 3736	1052	rundll32.exe	83
PID 1052 wrote to memory of 3736	1052	rundll32.exe	83
PID 1052 wrote to memory of 3736	1052	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\289d4cd3b760ada40c313148c2f4c7e4_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1052
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\289d4cd3b760ada40c313148c2f4c7e4_JaffaCakes118.dll,#1
  2⤵
  PID:3736
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3736 -s 580
    3⤵
    - Program crash
    PID:3760

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3736 -ip 3736
1⤵
PID:2348

memory/3736-0-0x0000000000740000-0x0000000000741000-memory.dmp

Filesize
4KB

Download