a8e91740acd8d7030090e6ebbed10aaac9dadf525ac3e1882c887115c2ed3299

Analysis

max time kernel
94s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
09/07/2024, 10:13

Target

2ff53ca2d7fd13717b1abdfacb7d2fce_JaffaCakes118.dll
Size

45KB
MD5

2ff53ca2d7fd13717b1abdfacb7d2fce
SHA1

c6aec93f6711470df638d6a58e1eab018e155c54
SHA256

a8e91740acd8d7030090e6ebbed10aaac9dadf525ac3e1882c887115c2ed3299
SHA512

db78077b9fdb56b38edc361b1c1ac5b59390dcbd8d3cc5d27e98fd3cc8aa47c09164d26ae3567027c286eb0f9054b54b86b30ee6508becc5f1fa5136c0b187c2
SSDEEP

768:+cbYhtNqXhPOa5PSayB7CDweXAa1Q8jwFzM8fHPf4BPfQO0P+SOxofEQXo93:+dhtERPOgPStBk3BnWHH4BHnwNE4o

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
336	3868	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 644 wrote to memory of 3868	644	rundll32.exe	82
PID 644 wrote to memory of 3868	644	rundll32.exe	82
PID 644 wrote to memory of 3868	644	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2ff53ca2d7fd13717b1abdfacb7d2fce_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:644
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2ff53ca2d7fd13717b1abdfacb7d2fce_JaffaCakes118.dll,#1
  2⤵
  PID:3868
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3868 -s 580
    3⤵
    - Program crash
    PID:336

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3868 -ip 3868
1⤵
PID:1568

memory/3868-0-0x0000000000580000-0x0000000000581000-memory.dmp

Filesize
4KB

Download