b47a82268dbb570c9bf65bfb1017fa5fc8cc7f13ff6156e2e6c05846cb8b54d9

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240708-en
resource tags

arch:x64arch:x86image:win10v2004-20240708-enlocale:en-usos:windows10-2004-x64system
submitted
09/07/2024, 07:32

Target

2f7a17dcbcfe92370dffc28c257537f6_JaffaCakes118.dll
Size

204KB
MD5

2f7a17dcbcfe92370dffc28c257537f6
SHA1

1c136dac161fbc0b4a647922c7bc138f7ad8dfcb
SHA256

b47a82268dbb570c9bf65bfb1017fa5fc8cc7f13ff6156e2e6c05846cb8b54d9
SHA512

0af1bb8676f5a540679f1794e79646fbec9b7995bb53c00252241ac5f633786aaed588bc6af7e6d3700c1107ffeef84e011699e789852a3f931fe23ef8198dd7
SSDEEP

3072:/PX+LxI7GWlMZdyDIT3v9nxRJ0lb5BvoVVp/PSccmRATm/0qHkcO5VnZrWOorsRd:xSm4xvootqDors3gk

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3620	1424	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1452 wrote to memory of 1424	1452	rundll32.exe	81
PID 1452 wrote to memory of 1424	1452	rundll32.exe	81
PID 1452 wrote to memory of 1424	1452	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2f7a17dcbcfe92370dffc28c257537f6_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1452
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2f7a17dcbcfe92370dffc28c257537f6_JaffaCakes118.dll,#1
  2⤵
  PID:1424
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1424 -s 592
    3⤵
    - Program crash
    PID:3620

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 192 -p 1424 -ip 1424
1⤵
PID:208