59964b82d32abe523f7ac1cb79cc6f93483b88f55b63ecd81bb00ac938e378f3

Analysis

max time kernel
94s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
09-07-2024 21:48

Target

321a7d4bdc919a825749c0e4064129da_JaffaCakes118.dll
Size

48KB
MD5

321a7d4bdc919a825749c0e4064129da
SHA1

1545f141be6aa9d320f7f40af4760d66f162c962
SHA256

59964b82d32abe523f7ac1cb79cc6f93483b88f55b63ecd81bb00ac938e378f3
SHA512

57eff76b77b57c728a98c8700917b2ee86bd4a6043d1d83e982e6c69c0c152cc86166ebc1fe6e13e7536a4bd45739ca77635c6b8a5f5a5527851e5589abe51af
SSDEEP

768:K8fV/pK5iLQVxGDJvS+WIlo2MPFnuHChSVoL/95GSczyn9zXo91kA:/fV/BLCGDJvg2gYCnGScu9bo1

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2888	3896	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5040 wrote to memory of 3896	5040	rundll32.exe	81
PID 5040 wrote to memory of 3896	5040	rundll32.exe	81
PID 5040 wrote to memory of 3896	5040	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\321a7d4bdc919a825749c0e4064129da_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5040
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\321a7d4bdc919a825749c0e4064129da_JaffaCakes118.dll,#1
  2⤵
  PID:3896
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3896 -s 608
    3⤵
    - Program crash
    PID:2888

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3896 -ip 3896
1⤵
PID:3228

memory/3896-0-0x0000000000930000-0x0000000000931000-memory.dmp

Filesize
4KB

Download
memory/3896-1-0x0000000000A90000-0x0000000000B66000-memory.dmp

Filesize
856KB

Download