9970b2120687b75cd59b0b0ef2a94d0443c3521113504e6e4d7b588f1a5d206e

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
09-07-2024 06:29

Target

2f4e6e49ab2cce08f795e6099e23734f_JaffaCakes118.dll
Size

72KB
MD5

2f4e6e49ab2cce08f795e6099e23734f
SHA1

71f85fefce874d941afdf6861b931d27cafa7aa0
SHA256

9970b2120687b75cd59b0b0ef2a94d0443c3521113504e6e4d7b588f1a5d206e
SHA512

bcc47583357b2b4d9cace7f9518ddd5a0e8bfef8a185dd62050ff40fc3c4e360951d464cb750ba89ff5cc8416e2196dfe984f697a7978232a22f01fe2c5b64b8
SSDEEP

1536:Sjjl3nwzSuOqBubw/WgT6zMKAOK2lCWcQajhRuv:C5UOq0ukgOK2l7aFQv

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4364	4944	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 404 wrote to memory of 4944	404	rundll32.exe	84
PID 404 wrote to memory of 4944	404	rundll32.exe	84
PID 404 wrote to memory of 4944	404	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2f4e6e49ab2cce08f795e6099e23734f_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:404
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2f4e6e49ab2cce08f795e6099e23734f_JaffaCakes118.dll,#1
  2⤵
  PID:4944
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4944 -s 600
    3⤵
    - Program crash
    PID:4364

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4944 -ip 4944
1⤵
PID:2724