cd1620b6ab141cfca868adc8e8882084b03ae57d69f5c758485642883c4df22b

Analysis

max time kernel
93s
max time network
98s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
09/07/2024, 00:51

Target

2e6ef7523595316f610e4351f5ccafaa_JaffaCakes118.dll
Size

457KB
MD5

2e6ef7523595316f610e4351f5ccafaa
SHA1

668de042b28e479c0d914cb3c66043017b26599c
SHA256

cd1620b6ab141cfca868adc8e8882084b03ae57d69f5c758485642883c4df22b
SHA512

3f714b0f64548c9750e89f8b47aedc2abf53fd352f55dc242ce1bfc13930e3d3f32121be3b8e9ac4f49edc2095035f9186008d99ee8911fef9e4a9443ad0a37f
SSDEEP

12288:66HTgzVOOn5N2CPH16khSL8NJTpdhnboYseGt8Y:5HTgztn5NtPH16khSL8jpdrGt8Y

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
532	320	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1476 wrote to memory of 320	1476	rundll32.exe	82
PID 1476 wrote to memory of 320	1476	rundll32.exe	82
PID 1476 wrote to memory of 320	1476	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2e6ef7523595316f610e4351f5ccafaa_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1476
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2e6ef7523595316f610e4351f5ccafaa_JaffaCakes118.dll,#1
  2⤵
  PID:320
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 320 -s 600
    3⤵
    - Program crash
    PID:532

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 320 -ip 320
1⤵
PID:4320