9f5e0631ae0e44a2f421b1ff02fbb329e83e6f1f8c758d9cd500fc055fffbcd9

Analysis

max time kernel
93s
max time network
98s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
09/07/2024, 01:11

Target

2e7c48b5b6d35670bac0499ed2b6a2d4_JaffaCakes118.dll
Size

44KB
MD5

2e7c48b5b6d35670bac0499ed2b6a2d4
SHA1

347ee50e4f869cdb7aa28a8a6f4b160a500e229a
SHA256

9f5e0631ae0e44a2f421b1ff02fbb329e83e6f1f8c758d9cd500fc055fffbcd9
SHA512

8b98ff46c1ef1184713be4b66cbad95fccb6a6661c4e7e442f89566d682d9739b6628100449272d5ee75e98db088db573624cc0097a50b83c2f6e3aa0f4fd2b1
SSDEEP

768:cXvB/yuK+81EfdEx05UMnvDHC2+WhilczxmuZRJzMv:cXv19iGExcUMnvDHC2+3czx1Z

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4136	3404	WerFault.exe	82

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3404	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 856 wrote to memory of 3404	856	rundll32.exe	82
PID 856 wrote to memory of 3404	856	rundll32.exe	82
PID 856 wrote to memory of 3404	856	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2e7c48b5b6d35670bac0499ed2b6a2d4_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:856
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2e7c48b5b6d35670bac0499ed2b6a2d4_JaffaCakes118.dll,#1
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  PID:3404
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3404 -s 960
    3⤵
    - Program crash
    PID:4136

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3404 -ip 3404
1⤵
PID:4440