b0f3ba0952944573f0b5ec01051c8fa9270fd3342b91118397b1a877179345fd

Analysis

max time kernel
149s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
11/07/2024, 00:04

Target

36f0e5e43e217ccb428da48ef1d68f26_JaffaCakes118.dll
Size

30KB
MD5

36f0e5e43e217ccb428da48ef1d68f26
SHA1

72ee36244a61fb1818ad82a464ef37e6095b1159
SHA256

b0f3ba0952944573f0b5ec01051c8fa9270fd3342b91118397b1a877179345fd
SHA512

19dc203870152f11b15273653c6e029cd3b401c9a368188b16e4125afa0766b5eb1849799f2c6e2a2987f63cb5989fedc1cb4a8bc78581ab4b0f026fd274abc8
SSDEEP

768:hfHlcFr5klQLSmwTm43vYO3rCkItZDW9I:hQdSmH43vYO7psZC

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
652	612	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 320 wrote to memory of 612	320	rundll32.exe	83
PID 320 wrote to memory of 612	320	rundll32.exe	83
PID 320 wrote to memory of 612	320	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\36f0e5e43e217ccb428da48ef1d68f26_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:320
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\36f0e5e43e217ccb428da48ef1d68f26_JaffaCakes118.dll,#1
  2⤵
  PID:612
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 612 -s 564
    3⤵
    - Program crash
    PID:652

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 612 -ip 612
1⤵
PID:5016

memory/612-0-0x0000000010000000-0x0000000010018000-memory.dmp

Filesize
96KB

Download