11e8f8a82f4bf7d81559c7afdc6fc7462ae820dadf11ed811acf973a145f5113

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
10-07-2024 21:12

Target

36666caddabf2bf488b8924924e33db3_JaffaCakes118.dll
Size

113KB
MD5

36666caddabf2bf488b8924924e33db3
SHA1

7b14c374825c58d85c690da3129e04e7bc4b1109
SHA256

11e8f8a82f4bf7d81559c7afdc6fc7462ae820dadf11ed811acf973a145f5113
SHA512

a7a06c9b1570466ba14fd4cd0f6be7745dc41680d789d64d84da1705e7beb104eb935775b8177b6ea365c233ecc0fb35f3fb521367f50edba7ba4684d40afabc
SSDEEP

3072:uWD6In9QPsSLmfcso6LjSGMH2d+y94lgsdM9Ys/:uSdkPsXPS1y9Iu/

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4648 5076 WerFault.exe rundll32.exe

pid	pid_target	process	target process
4648	5076	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4572 wrote to memory of 5076	4572	rundll32.exe	rundll32.exe
PID 4572 wrote to memory of 5076	4572	rundll32.exe	rundll32.exe
PID 4572 wrote to memory of 5076	4572	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\36666caddabf2bf488b8924924e33db3_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4572

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\36666caddabf2bf488b8924924e33db3_JaffaCakes118.dll,#1
2⤵
PID:5076

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5076 -s 636
3⤵
- Program crash
PID:4648

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5076 -ip 5076
1⤵
PID:2648

memory/5076-0-0x0000000000FC0000-0x0000000000FCF000-memory.dmp

Filesize
60KB

Download
memory/5076-1-0x0000000001030000-0x0000000001050000-memory.dmp

Filesize
128KB

Download
memory/5076-5-0x0000000010000000-0x0000000010020000-memory.dmp

Filesize
128KB

Download
memory/5076-6-0x0000000000FC0000-0x0000000000FCF000-memory.dmp

Filesize
60KB

Download