11db4e1bd1226d8a855e69ff67ed813cd89bff3d0b3bf37eccf329775a0f3ad8

Analysis

max time kernel
93s
max time network
101s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
08/07/2024, 12:43

Target

2c63b21ba4bb08cefeb4fed1313832b5_JaffaCakes118.dll
Size

4KB
MD5

2c63b21ba4bb08cefeb4fed1313832b5
SHA1

bf1134fce68f539348b6ba76b3d93767025d6682
SHA256

11db4e1bd1226d8a855e69ff67ed813cd89bff3d0b3bf37eccf329775a0f3ad8
SHA512

09f2f6c50e0dfdc727902f6561952cac0d91360cee16b2b62f8f55d2ce1b9ba348430a21761e17218ae2d2973b9e192c5fec7928c3af886e53abdcdd6f36b2fb

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2832	3696	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3180 wrote to memory of 3696	3180	rundll32.exe	82
PID 3180 wrote to memory of 3696	3180	rundll32.exe	82
PID 3180 wrote to memory of 3696	3180	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2c63b21ba4bb08cefeb4fed1313832b5_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3180
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2c63b21ba4bb08cefeb4fed1313832b5_JaffaCakes118.dll,#1
  2⤵
  PID:3696
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3696 -s 604
    3⤵
    - Program crash
    PID:2832

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 3696 -ip 3696
1⤵
PID:4864