e21f9b8a9a46c2dfc73969590b76d5611d04e7bc7d42678320d4dc2c7a665952

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
11/07/2024, 22:10

Target

3ae7c9b5d5ac85f16f7674d8c9ba4e45_JaffaCakes118.dll
Size

72KB
MD5

3ae7c9b5d5ac85f16f7674d8c9ba4e45
SHA1

dad0f543ac10f10b43224046e98af7b93b4fcb54
SHA256

e21f9b8a9a46c2dfc73969590b76d5611d04e7bc7d42678320d4dc2c7a665952
SHA512

479e11b20f7755ce4be1b88abbbebd4422007025169e4eb3d73ce59800c75ad9f9cc7e5ed83a27beb71670f70decc9414c2f1373566381bd7f5a51ed600be5f5
SSDEEP

1536:Sjjl3nwzSuOqBubw/WgT6zMKAOK2lCWcQajhRuv:C5UOq0ukgOK2l7aFQv

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
212	3008	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1644 wrote to memory of 3008	1644	rundll32.exe	83
PID 1644 wrote to memory of 3008	1644	rundll32.exe	83
PID 1644 wrote to memory of 3008	1644	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3ae7c9b5d5ac85f16f7674d8c9ba4e45_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1644
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3ae7c9b5d5ac85f16f7674d8c9ba4e45_JaffaCakes118.dll,#1
  2⤵
  PID:3008
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3008 -s 600
    3⤵
    - Program crash
    PID:212

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 356 -p 3008 -ip 3008
1⤵
PID:948