7d111a8b5f3a320395b88504d8cb5c90364d0d8c1fef462bc2933f9c6cfe55f9

Analysis

max time kernel
93s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
10-07-2024 21:10

Target

36654474c6ff82082ca14ecf69145a28_JaffaCakes118.dll
Size

9KB
MD5

36654474c6ff82082ca14ecf69145a28
SHA1

47f3b7078633dcbdf26142a2ccf3a5405be2fb7a
SHA256

7d111a8b5f3a320395b88504d8cb5c90364d0d8c1fef462bc2933f9c6cfe55f9
SHA512

b22e1d419db22659b2fc1c5348f3324b7c890231b4a8cf0e5231621db8aa58f8da304a05c8bccf4ed7834ffc151934f8f50cdd61f70e466a0192b97df5bb9c05
SSDEEP

96:qJV7dR7uwEU+hCT3GrxZ4MUtPNlz0MdG8EWvdM3IWwG3Sv:wuwEt8rsTUtPLzKNWSYWFSv

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

5012 4916 WerFault.exe rundll32.exe

pid	pid_target	process	target process
5012	4916	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3224 wrote to memory of 4916	3224	rundll32.exe	rundll32.exe
PID 3224 wrote to memory of 4916	3224	rundll32.exe	rundll32.exe
PID 3224 wrote to memory of 4916	3224	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\36654474c6ff82082ca14ecf69145a28_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3224

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\36654474c6ff82082ca14ecf69145a28_JaffaCakes118.dll,#1
2⤵
PID:4916

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4916 -s 580
3⤵
- Program crash
PID:5012

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4916 -ip 4916
1⤵
PID:3472

memory/4916-0-0x0000000000F80000-0x0000000000F87000-memory.dmp

Filesize
28KB

Download