aeee801bf6248e6bc6ad836b11c59b67bf4c4a478e6f362a514e56153ad8c8c3

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
11/07/2024, 01:13

Target

3726d8c7eec746ab4f09c7c57ed52ad0_JaffaCakes118.dll
Size

162KB
MD5

3726d8c7eec746ab4f09c7c57ed52ad0
SHA1

69e5005ed78bc154f809afffd468a14e744d0d99
SHA256

aeee801bf6248e6bc6ad836b11c59b67bf4c4a478e6f362a514e56153ad8c8c3
SHA512

9bf94ec6ec26f65eb5d5850784b9859fd7aa607703436fef5b5bd38a224034bc55458ee190bea715ebc754b11b2d5599edc716b3bd42ff55a1cff06204279ecc
SSDEEP

1536:CzYqX3yK1nVWC86c1ha32hHrHvpdmWfmdrOBjBx6KBQK46Llrn+bHm:CzY/ePDGhaEHyWfOSHxNsWKG

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1628	4044	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2924 wrote to memory of 4044	2924	rundll32.exe	83
PID 2924 wrote to memory of 4044	2924	rundll32.exe	83
PID 2924 wrote to memory of 4044	2924	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3726d8c7eec746ab4f09c7c57ed52ad0_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2924
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3726d8c7eec746ab4f09c7c57ed52ad0_JaffaCakes118.dll,#1
  2⤵
  PID:4044
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4044 -s 596
    3⤵
    - Program crash
    PID:1628

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4044 -ip 4044
1⤵
PID:3040