32fba5d20dfcfbc3a982a169e7b9930c60b6ad6dc677c1334f570859f052a775

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
08/07/2024, 18:39

Target

2d68523eb00d908b0408b1ab8c2e44be_JaffaCakes118.dll
Size

48KB
MD5

2d68523eb00d908b0408b1ab8c2e44be
SHA1

dcf9cb356b4046c18bc9e71ba7b4d715168ca31e
SHA256

32fba5d20dfcfbc3a982a169e7b9930c60b6ad6dc677c1334f570859f052a775
SHA512

4258c71548575001d037a5ef51b760e99ed1c68469913005c01943de5ce1b642884d77325cde618d82dfe01e7f16be2beccbe6eeedb7a85a0fe8c06c72696ff1
SSDEEP

768:XDuY7ECefc71ZlQDL9yw0pwTsvbchFdSYKJRL941JHro9Di4c:yie6QDZT0pwTsvYAYKPsJoJdc

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4168	3320	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1472 wrote to memory of 3320	1472	rundll32.exe	81
PID 1472 wrote to memory of 3320	1472	rundll32.exe	81
PID 1472 wrote to memory of 3320	1472	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2d68523eb00d908b0408b1ab8c2e44be_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1472
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2d68523eb00d908b0408b1ab8c2e44be_JaffaCakes118.dll,#1
  2⤵
  PID:3320
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3320 -s 620
    3⤵
    - Program crash
    PID:4168

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 3320 -ip 3320
1⤵
PID:556