00de4cab65c6198fe77190448836642a2354a8ab08b5be1c2506b0cb8d6fdb02

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
08-07-2024 19:51

Target

2d9c2eb8433d0551fb57bbc04a41ab33_JaffaCakes118.dll
Size

9KB
MD5

2d9c2eb8433d0551fb57bbc04a41ab33
SHA1

77fdf736531bd96f8b036f0537519e5da19bb71d
SHA256

00de4cab65c6198fe77190448836642a2354a8ab08b5be1c2506b0cb8d6fdb02
SHA512

fdd0f24e24505758fa81ad8129610984d494c80cbc5633ccee3cceb4883cb1ab0fafcc6bce80250f5f6c8b1e42d01868cc8a792b584f9740ab6e96751a7db658
SSDEEP

96:q1V7dR7uwEU+hCT3GrxZ4MUtPNlz0MdG8EWvdM3IWwG34b:kuwEt8rsTUtPLzKNWSYWF4b

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4412	860	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4500 wrote to memory of 860	4500	rundll32.exe	82
PID 4500 wrote to memory of 860	4500	rundll32.exe	82
PID 4500 wrote to memory of 860	4500	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2d9c2eb8433d0551fb57bbc04a41ab33_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4500
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2d9c2eb8433d0551fb57bbc04a41ab33_JaffaCakes118.dll,#1
  2⤵
  PID:860
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 860 -s 624
    3⤵
    - Program crash
    PID:4412

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 860 -ip 860
1⤵
PID:4164

memory/860-0-0x0000000001350000-0x0000000001357000-memory.dmp

Filesize
28KB

Download
memory/860-1-0x0000000001350000-0x0000000001357000-memory.dmp

Filesize
28KB

Download