71079a2d8b34ea9dfd4f214cb1fa47e222b0aeb3749eb51bf4e9a2aa0ee0ae52

Analysis

max time kernel
94s
max time network
98s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
08-07-2024 05:12

Target

2b188b77c8e9ba55edc4bf7b66c3b245_JaffaCakes118.dll
Size

48KB
MD5

2b188b77c8e9ba55edc4bf7b66c3b245
SHA1

7b83aed4390a36ef29e5011ae6f2e76706b7460d
SHA256

71079a2d8b34ea9dfd4f214cb1fa47e222b0aeb3749eb51bf4e9a2aa0ee0ae52
SHA512

e30ac1409bbbfa4736bb11470e93af13fbf5a4870440929249294803982a7c05569ccb0e9e171a57debce9378509464486e5ff5e3e3424f3af21ce170aa57d2f
SSDEEP

768:KrY2Z1EDhOFQjkVNOSPPLLKnpJjn1LyC8p0+mtGAMoci/mU5QyLP20Pa2KJJRT1:w/4DYyjkxP/Cj1mCJEroSwT7gT1

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4460	1088	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4992 wrote to memory of 1088	4992	rundll32.exe	82
PID 4992 wrote to memory of 1088	4992	rundll32.exe	82
PID 4992 wrote to memory of 1088	4992	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2b188b77c8e9ba55edc4bf7b66c3b245_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4992
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2b188b77c8e9ba55edc4bf7b66c3b245_JaffaCakes118.dll,#1
  2⤵
  PID:1088
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1088 -s 560
    3⤵
    - Program crash
    PID:4460

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1088 -ip 1088
1⤵
PID:4736

memory/1088-0-0x0000000010000000-0x000000001001D000-memory.dmp

Filesize
116KB

Download