a8a4c7ac738eea5ac5b63f85c422ea923bdcaf6e4d52ad1b50202ed0de39acc8

Analysis

max time kernel
94s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
09/07/2024, 20:39

Target
31e528a44eeddb967f3a1e8d6e2db9a8_JaffaCakes118.dll
Size 9KB
Sample240709-zfk2eawdnb
SHA256 a8a4c7ac738eea5ac5b63f85c422ea923bdcaf6e4d52ad1b50202ed0de39acc8
MD5 31e528a44eeddb967f3a1e8d6e2db9a8
SHA1 b41746d1ca08d4fa40246346680592b2c062fd14
SHA512 65d27f8b9613889e7e56d7a2c7d19aad65f5de6acc812f64c22d59545f43a8a0771efbdf35b0a7985f74ab5fbba0c95dbdac5f7ca8a04a03416c72fcb103d661
SSDEEP 96:KKbhvyrDolc/vpqXsRzmb4nDOROCQ6tleiol1v/3BFXWI7j2RQFqIO6:KKEQlodRzvO4WL4LxFXWIJFB7
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2488	640	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2212 wrote to memory of 640	2212	rundll32.exe	83
PID 2212 wrote to memory of 640	2212	rundll32.exe	83
PID 2212 wrote to memory of 640	2212	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\31e528a44eeddb967f3a1e8d6e2db9a8_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2212
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\31e528a44eeddb967f3a1e8d6e2db9a8_JaffaCakes118.dll,#1
  2⤵
  PID:640
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 640 -s 548
    3⤵
    - Program crash
    PID:2488

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 640 -ip 640
1⤵
PID:1080

memory/640-0-0x0000000010000000-0x0000000010009000-memory.dmp

Download