68503b841043681dc11089e57aad04323b6ad37e329fd9dbcd52637f2eb43abd

Analysis

max time kernel
91s
max time network
99s
platform
windows10-2004_x64
resource
win10v2004-20240708-en
resource tags

arch:x64arch:x86image:win10v2004-20240708-enlocale:en-usos:windows10-2004-x64system
submitted
09/07/2024, 03:16

Target
2ecef04c0653f7b57f326b1b11f57f74_JaffaCakes118.dll
Size 83KB
Sample240709-dsxebatcrq
SHA256 68503b841043681dc11089e57aad04323b6ad37e329fd9dbcd52637f2eb43abd
MD5 2ecef04c0653f7b57f326b1b11f57f74
SHA1 34584c8d7a47a61bc2100f9a677d58ddd14177ce
SHA512 c410e117b006342a2c9ac70d97e0b1b2f126ed74d9d7aa3897d42fc753946eee273bb82a199da52606425be4c9f170bfa61a579ed56b5a13dbef496456bfe264
SSDEEP 1536:sye0UvffSSKNA65rR5jbElLnNfnSYEv02mI4RxR39YJkiz2zP21ryLGyC:sye0UvHSSKNA65rrj0LnRnSYEvivX/PC
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4188	2248	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4696 wrote to memory of 2248	4696	rundll32.exe	82
PID 4696 wrote to memory of 2248	4696	rundll32.exe	82
PID 4696 wrote to memory of 2248	4696	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2ecef04c0653f7b57f326b1b11f57f74_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4696
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2ecef04c0653f7b57f326b1b11f57f74_JaffaCakes118.dll,#1
  2⤵
  PID:2248
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2248 -s 544
    3⤵
    - Program crash
    PID:4188

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 2248 -ip 2248
1⤵
PID:3868

memory/2248-0-0x0000000010000000-0x0000000010027000-memory.dmp

Download