650f521d63f49f7b53f82c3b4f7f677a1648c2b95d146d51bfd7a2d506b08026

Analysis

max time kernel
92s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
07-07-2024 02:54

Target

29af72b0a7053f0b1a0f556906059dfb_JaffaCakes118.dll
Size

307KB
MD5

29af72b0a7053f0b1a0f556906059dfb
SHA1

4e9f7622dd6436ec45d041960a7e2901dd3f80d7
SHA256

650f521d63f49f7b53f82c3b4f7f677a1648c2b95d146d51bfd7a2d506b08026
SHA512

250fce94fc88f67d72a7714a289dca30ddf51d8d9932781baee837d765787d8df9b9b530acc442f04e46a2aaeb89403a230f810a08a732066d3883407589bb7e
SSDEEP

6144:IpiMX4cFPFOlzgSNEu/IZK9UpRnXZ9zdzm/zDm8Ayyutv8PkliYop+2DNPg:IpiMX4gIzB/IwUpRnH8/O8AyyHPkj0I

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4760	2468	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 624 wrote to memory of 2468	624	rundll32.exe	82
PID 624 wrote to memory of 2468	624	rundll32.exe	82
PID 624 wrote to memory of 2468	624	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\29af72b0a7053f0b1a0f556906059dfb_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:624
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\29af72b0a7053f0b1a0f556906059dfb_JaffaCakes118.dll,#1
  2⤵
  PID:2468
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2468 -s 552
    3⤵
    - Program crash
    PID:4760

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2468 -ip 2468
1⤵
PID:664

memory/2468-0-0x0000000010000000-0x000000001009F000-memory.dmp

Filesize
636KB

Download