b0100650c4f20488cc6e0b57c3e1f9ba7bbd138c060d28b83207322270e12256

Analysis

max time kernel
92s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
08/07/2024, 14:14

Target

2ca93b1d1c9eece0f275393af188d046_JaffaCakes118.dll
Size

122KB
MD5

2ca93b1d1c9eece0f275393af188d046
SHA1

7947f9c6e1aaf6ba06c51356b4e0eb5ee119710b
SHA256

b0100650c4f20488cc6e0b57c3e1f9ba7bbd138c060d28b83207322270e12256
SHA512

72c5d61c43be213259c9de72c5e03c146ec15028b290d55d081e502c29ddf38fc7866424e92c9131b3f2897654af02d5782b204523bcad0e8aa620a0518284b2
SSDEEP

3072:zl+/A+5umUdBvuI5kGlZ6wayjtMpkEAQ8WCvKpdXbb:XGumuBmIuwa3uOzrb

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4556	4980	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3972 wrote to memory of 4980	3972	rundll32.exe	82
PID 3972 wrote to memory of 4980	3972	rundll32.exe	82
PID 3972 wrote to memory of 4980	3972	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2ca93b1d1c9eece0f275393af188d046_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3972
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2ca93b1d1c9eece0f275393af188d046_JaffaCakes118.dll,#1
  2⤵
  PID:4980
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4980 -s 548
    3⤵
    - Program crash
    PID:4556

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4980 -ip 4980
1⤵
PID:2716

memory/4980-0-0x0000000010000000-0x000000001005A000-memory.dmp

Filesize
360KB

Download