b0dbfb9d9cff5d916734a3f6e451169b1403c2fc6f93d8085692ea031ef5d5fa

Analysis

max time kernel
94s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
10/07/2024, 00:54

Target

32ae8b53e19194061ef863754c030774_JaffaCakes118.dll
Size

122KB
MD5

32ae8b53e19194061ef863754c030774
SHA1

89742cb6024e0e687675114d8723ce49bf945b86
SHA256

b0dbfb9d9cff5d916734a3f6e451169b1403c2fc6f93d8085692ea031ef5d5fa
SHA512

7901e2f19fceaaca1d803f7671508da80df4f299a8c28f80e9c66622a73c9a3284eb28e36544108f227404686defd536bb4dbc0bb53352254ca3cf3ff94571a3
SSDEEP

3072:RELB2y4S0pYils6K06dATpk54NbNSaKqksdy8I:RYJ4kiu6xEATWEPKqkQ

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2732	1932	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1144 wrote to memory of 1932	1144	rundll32.exe	81
PID 1144 wrote to memory of 1932	1144	rundll32.exe	81
PID 1144 wrote to memory of 1932	1144	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\32ae8b53e19194061ef863754c030774_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1144
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\32ae8b53e19194061ef863754c030774_JaffaCakes118.dll,#1
  2⤵
  PID:1932
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1932 -s 612
    3⤵
    - Program crash
    PID:2732

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 1932 -ip 1932
1⤵
PID:3904

memory/1932-1-0x0000000000DE0000-0x0000000000E02000-memory.dmp

Filesize
136KB

Download
memory/1932-0-0x0000000000BF0000-0x0000000000C00000-memory.dmp

Filesize
64KB

Download
memory/1932-5-0x0000000000BF0000-0x0000000000BF1000-memory.dmp

Filesize
4KB

Download