b1beb8f47e5c3968efcbb486b22c52347c168814c57595c0c17cc427da73e1a6

Analysis

max time kernel
95s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
09/07/2024, 20:22

Target

31d69a93640bb55834ec38dd3bf886de_JaffaCakes118.dll
Size

2KB
MD5

31d69a93640bb55834ec38dd3bf886de
SHA1

2203c13907dcd5d0f2acf36994ee5d0d75b30a4e
SHA256

b1beb8f47e5c3968efcbb486b22c52347c168814c57595c0c17cc427da73e1a6
SHA512

9de6abb4298fc24366c86857db864e4466f75b43353cf96623f59ce07aeb0a2daf3756b17e8f0787c01cdb31780f73f719c524a349b675afc3b45d0ee511f63f

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4852	2164	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4680 wrote to memory of 2164	4680	rundll32.exe	81
PID 4680 wrote to memory of 2164	4680	rundll32.exe	81
PID 4680 wrote to memory of 2164	4680	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\31d69a93640bb55834ec38dd3bf886de_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4680
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\31d69a93640bb55834ec38dd3bf886de_JaffaCakes118.dll,#1
  2⤵
  PID:2164
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2164 -s 564
    3⤵
    - Program crash
    PID:4852

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2164 -ip 2164
1⤵
PID:4912

memory/2164-0-0x0000000010000000-0x0000000010010000-memory.dmp

Filesize
64KB

Download