4782c9b8b15d2e84a0c1ec93ef3e9cea1f76c40bb32ca6bec6b2873634191cc6

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
10/07/2024, 21:16

Target

366a6febe218c5e42a2c38f1fe819802_JaffaCakes118.dll
Size

32KB
MD5

366a6febe218c5e42a2c38f1fe819802
SHA1

e9dd85b63987191f4285b254547afaf5d0cd3fbb
SHA256

4782c9b8b15d2e84a0c1ec93ef3e9cea1f76c40bb32ca6bec6b2873634191cc6
SHA512

8a6ca14ca47e98cf4e9512183f5f4a993665bae0f4b1a40c433c1a2b65622985179510f70fd960ef73e217fdcbc0ffe2b0ebe2fe1926f39b6cb4ab50c484051e
SSDEEP

768:nIDnb6ccqhO1eWrme5/kOM0tScFzSu0ZRJlt:nIn6ahO1L5/kORUcNqZL

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1808	3592	WerFault.exe	82

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3592	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4188 wrote to memory of 3592	4188	rundll32.exe	82
PID 4188 wrote to memory of 3592	4188	rundll32.exe	82
PID 4188 wrote to memory of 3592	4188	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\366a6febe218c5e42a2c38f1fe819802_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4188
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\366a6febe218c5e42a2c38f1fe819802_JaffaCakes118.dll,#1
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  PID:3592
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3592 -s 960
    3⤵
    - Program crash
    PID:1808

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3592 -ip 3592
1⤵
PID:1980