d46075bef9ec63e5ca53187fb26987f13b6e9995cb446ad54414e721544f33fa

Analysis

max time kernel
93s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
11-07-2024 03:48

Target

37987639cfb0fab4ba112908bf2629d8_JaffaCakes118.dll
Size

72KB
MD5

37987639cfb0fab4ba112908bf2629d8
SHA1

2997e0bc59d89247ce18b766e9f80b691cd1df4c
SHA256

d46075bef9ec63e5ca53187fb26987f13b6e9995cb446ad54414e721544f33fa
SHA512

794d8c6de67362711339be1e62d6434979281b2b3c5652f02dbaeeba9087482565c6429fee6fa7c850237fb75c86caf67dd3bbda079e185bfb7fc7c37dcb7948
SSDEEP

1536:Sjjl3nwzSuOqBubw/WgT6zMKAOK2lCWcQajhRuP:C5UOq0ukgOK2l7aFQP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2620	4296	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1864 wrote to memory of 4296	1864	rundll32.exe	83
PID 1864 wrote to memory of 4296	1864	rundll32.exe	83
PID 1864 wrote to memory of 4296	1864	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\37987639cfb0fab4ba112908bf2629d8_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1864
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\37987639cfb0fab4ba112908bf2629d8_JaffaCakes118.dll,#1
  2⤵
  PID:4296
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4296 -s 600
    3⤵
    - Program crash
    PID:2620

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4296 -ip 4296
1⤵
PID:1504