cd7b56b4aa66aa3e562acc5c521f76ec25a62acbd34cfa5079f18c1290e07096

Analysis

max time kernel
92s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
10/07/2024, 03:41

Target

332b7e84a0438996bf469e9acc70267d_JaffaCakes118.dll
Size

2KB
MD5

332b7e84a0438996bf469e9acc70267d
SHA1

0ebd58e233577be789d44b6d8555b477d6d5f607
SHA256

cd7b56b4aa66aa3e562acc5c521f76ec25a62acbd34cfa5079f18c1290e07096
SHA512

0af153a5cb8d01ccf06d5eb82160d5661177edcb372ea1a5625a26eaaafbd050e3c91099a5bcfd383e6815168058bdff3a6c7f60dbd8464cf6a8c0071415cc16

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3520	1628	WerFault.exe	80

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3040 wrote to memory of 1628	3040	rundll32.exe	80
PID 3040 wrote to memory of 1628	3040	rundll32.exe	80
PID 3040 wrote to memory of 1628	3040	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\332b7e84a0438996bf469e9acc70267d_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3040
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\332b7e84a0438996bf469e9acc70267d_JaffaCakes118.dll,#1
  2⤵
  PID:1628
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1628 -s 548
    3⤵
    - Program crash
    PID:3520

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1628 -ip 1628
1⤵
PID:4348

memory/1628-0-0x0000000010000000-0x0000000010035000-memory.dmp

Filesize
212KB

Download