38182ce25b89fb0e1fd35a94c94e52abc82eff0e4523f1a4841da826fe717cbf

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
10/07/2024, 12:22

Target

34b292354e96c327bf964f2b627338cf_JaffaCakes118.dll
Size

14KB
MD5

34b292354e96c327bf964f2b627338cf
SHA1

9edfb6152dec8851c353543af924c3113046555c
SHA256

38182ce25b89fb0e1fd35a94c94e52abc82eff0e4523f1a4841da826fe717cbf
SHA512

d2705df3196a576f93f3bd6bcc635ccb46a64b1c70f7bb7935348d1f178f95fa95e7578425d6a7cb746346fa26bd99233ee9c0ce95c4c242ac1238d8bd22d889
SSDEEP

384:TJhu+wGuPzVM5WPHyRRRnx6Xgc2Sw2qr:TPhwGoVc+S9cY2

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1720	3440	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1708 wrote to memory of 3440	1708	rundll32.exe	82
PID 1708 wrote to memory of 3440	1708	rundll32.exe	82
PID 1708 wrote to memory of 3440	1708	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\34b292354e96c327bf964f2b627338cf_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1708
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\34b292354e96c327bf964f2b627338cf_JaffaCakes118.dll,#1
  2⤵
  PID:3440
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3440 -s 832
    3⤵
    - Program crash
    PID:1720

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 3440 -ip 3440
1⤵
PID:4692

memory/3440-0-0x0000000010000000-0x0000000010016000-memory.dmp

Filesize
88KB

Download
memory/3440-1-0x0000000010000000-0x0000000010016000-memory.dmp

Filesize
88KB

Download