624907f58e7450d71ca57244aa1a2b3edb1bf4e4e6a01181e9f9c54cb156c48d

Analysis

max time kernel
93s
max time network
122s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
09/07/2024, 18:33

Target

31803ee7d89e32d9974b961807f9575e_JaffaCakes118.dll
Size

72KB
MD5

31803ee7d89e32d9974b961807f9575e
SHA1

c77facb12f046a571fba7fc9e0b65936c65435a8
SHA256

624907f58e7450d71ca57244aa1a2b3edb1bf4e4e6a01181e9f9c54cb156c48d
SHA512

49bf8ee41bb10817017d249afdfe3995c3f66516ca47107fa8646223ec92a4b476b9b4b7a3c670d54a8194c33aa5f8f87fffba6b1dcaaefea288f2f225b15902
SSDEEP

1536:HgshApj0X4Lm+0VgYI9Rl3sInloSRlx2FfIm+8X9R+OgMN/rsTAmvlIBdBnlX:AsRILm/gv9RrLx2FfI78X9RQMNz4Amvw

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4708	1456	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3104 wrote to memory of 1456	3104	rundll32.exe	81
PID 3104 wrote to memory of 1456	3104	rundll32.exe	81
PID 3104 wrote to memory of 1456	3104	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\31803ee7d89e32d9974b961807f9575e_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3104
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\31803ee7d89e32d9974b961807f9575e_JaffaCakes118.dll,#1
  2⤵
  PID:1456
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1456 -s 560
    3⤵
    - Program crash
    PID:4708

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 1456 -ip 1456
1⤵
PID:3624

memory/1456-0-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download