6ff0a289634c6db0b780c143d18070956caa2db749592c45580e51ba1a858a75

Analysis

max time kernel
95s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
10/07/2024, 14:59

Target

3535e452d0b887eef37930d422aa34d4_JaffaCakes118.dll
Size

248KB
MD5

3535e452d0b887eef37930d422aa34d4
SHA1

ad278bdc0abebe8d1133f07ca5b1219796d23750
SHA256

6ff0a289634c6db0b780c143d18070956caa2db749592c45580e51ba1a858a75
SHA512

59e4a6da5e8bb728f714da578ea5080b436466e28472fd371d6c1383a5f20002ea457f24ffbad5da554921a2c8a2b6a9d89f0e42249c711345b7b07957af667d
SSDEEP

3072:82LNM7l+is9PzqaKRGNyWmArtIEboLYoFrNhjliYBtWrmIG/uru/CNxHLlNP4k1B:fL+cis9bqvWmASEbfIrBImIGKu/cTN

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3332	3312	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5020 wrote to memory of 3312	5020	rundll32.exe	81
PID 5020 wrote to memory of 3312	5020	rundll32.exe	81
PID 5020 wrote to memory of 3312	5020	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3535e452d0b887eef37930d422aa34d4_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5020
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3535e452d0b887eef37930d422aa34d4_JaffaCakes118.dll,#1
  2⤵
  PID:3312
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3312 -s 544
    3⤵
    - Program crash
    PID:3332

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3312 -ip 3312
1⤵
PID:4140