cbb9ea61f110247cd581ec6f6065f8d78f847e50025bb518e0278fe2f105879d

Analysis

max time kernel
150s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240708-en
resource tags

arch:x64arch:x86image:win10v2004-20240708-enlocale:en-usos:windows10-2004-x64system
submitted
09/07/2024, 00:36

Target

2e652c0fdefc281ce8bcbabc4e9b6525_JaffaCakes118.dll
Size

119KB
MD5

2e652c0fdefc281ce8bcbabc4e9b6525
SHA1

2e79889a2ee264452731abb21241334636b76dc5
SHA256

cbb9ea61f110247cd581ec6f6065f8d78f847e50025bb518e0278fe2f105879d
SHA512

c8e66c89e88b6423dffa25019359d2000bc43280074b3d8a7283efd81c0a7c9efb01f35851cfe4762c7a4a99b33b8e1f2b1f88eec34aa748c73c2fed22bfb2e7
SSDEEP

1536:CBhiQQDpxRSVW430wRu5OPmVd1GSSfe4KaXe9eGC4shg8mAvWBfvNAhIM/Bhp:6O93Svu5OPOdbSfJEwmAvWZvNBM/Bhp

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1684	3808	WerFault.exe	80

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5096 wrote to memory of 3808	5096	rundll32.exe	80
PID 5096 wrote to memory of 3808	5096	rundll32.exe	80
PID 5096 wrote to memory of 3808	5096	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2e652c0fdefc281ce8bcbabc4e9b6525_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5096
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2e652c0fdefc281ce8bcbabc4e9b6525_JaffaCakes118.dll,#1
  2⤵
  PID:3808
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3808 -s 540
    3⤵
    - Program crash
    PID:1684

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 3808 -ip 3808
1⤵
PID:4644

memory/3808-0-0x0000000010000000-0x0000000010042000-memory.dmp

Filesize
264KB

Download