d1e8e8fa4c35315a0bedb5fc2573f780e04cd5bbc14fabb14a262b137a0c7c34

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
09/07/2024, 18:49

Target

318c823024e80b9078a4e9f2b2f8c2fc_JaffaCakes118.dll
Size

174KB
MD5

318c823024e80b9078a4e9f2b2f8c2fc
SHA1

1e52b9ead419cc2ff0f8804d1b085c891463777f
SHA256

d1e8e8fa4c35315a0bedb5fc2573f780e04cd5bbc14fabb14a262b137a0c7c34
SHA512

8c6863dd1315a18e631dd702e289a08e2a3a6d96901a962b40366e6365fc6ecce91daa1edd585b7637691ab3c325b620dc490f79a030e7f6fac813c78b7efab6
SSDEEP

1536:91moQj+PGsGxPe7iGZQAbPVkbMeWCkglT/BpnayY896GWdLkAWWZz5f/lGuDXsRk:jmoQjEiGZZLgJnG8dWxlbsqsRFW

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3580	2876	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4776 wrote to memory of 2876	4776	rundll32.exe	83
PID 4776 wrote to memory of 2876	4776	rundll32.exe	83
PID 4776 wrote to memory of 2876	4776	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\318c823024e80b9078a4e9f2b2f8c2fc_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4776
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\318c823024e80b9078a4e9f2b2f8c2fc_JaffaCakes118.dll,#1
  2⤵
  PID:2876
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2876 -s 568
    3⤵
    - Program crash
    PID:3580

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2876 -ip 2876
1⤵
PID:4424