1af06934c6a0af0744fa4ac5c68cd17c4b084f72b647be0fd0ea3925650b8be0

Analysis

max time kernel
93s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
08/07/2024, 07:21

Target

2b72d06ae6192729439785bb4bd96da7_JaffaCakes118.dll
Size

564KB
MD5

2b72d06ae6192729439785bb4bd96da7
SHA1

6a7be2f2ab1e0233834f19f4d7e624905bafc5e5
SHA256

1af06934c6a0af0744fa4ac5c68cd17c4b084f72b647be0fd0ea3925650b8be0
SHA512

a70b0c05f677926202a94f2c771375d9390a97a9bdc09161090f20da47dadc88a7279ce98da33008d5746a2e77285870667ca80de7a2f20f72efda0729d67b65
SSDEEP

12288:V5G56dH2uDnkHE/aZS14/RSiRSuf7x/1d8r4so:+6h2GEESUFufV/fe

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3368	880	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1128 wrote to memory of 880	1128	rundll32.exe	82
PID 1128 wrote to memory of 880	1128	rundll32.exe	82
PID 1128 wrote to memory of 880	1128	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2b72d06ae6192729439785bb4bd96da7_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1128
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2b72d06ae6192729439785bb4bd96da7_JaffaCakes118.dll,#1
  2⤵
  PID:880
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 880 -s 672
    3⤵
    - Program crash
    PID:3368

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 880 -ip 880
1⤵
PID:3708

memory/880-0-0x00000000008E0000-0x0000000000962000-memory.dmp

Filesize
520KB

Download