4a301ae52b1a98f2979c1a2c538ec69c73d8f4879cba549171e10f0ea3b4f400

Analysis

max time kernel
95s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
11/07/2024, 08:34

Target

3868f12735f9bf03e8f9bee604b335fa_JaffaCakes118.dll
Size

104KB
MD5

3868f12735f9bf03e8f9bee604b335fa
SHA1

db41c877d0900b4f3f3fb6c03575c1b1f76e53cd
SHA256

4a301ae52b1a98f2979c1a2c538ec69c73d8f4879cba549171e10f0ea3b4f400
SHA512

f4e8e573bda6d9455113114378e67b273a484f1881550a46d4bc020e6e443a8099a04e9b1238e487ddcfe7df508d9c8d3ba70553393e33bcec95cfc8fc63a990
SSDEEP

1536:aym/YsQEyMjdtiF5gK13URajEjJMyap29kbHDnJd:aym/YsQEyMjyFCKxtjCME9gDnn

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2436	5008	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 940 wrote to memory of 5008	940	rundll32.exe	83
PID 940 wrote to memory of 5008	940	rundll32.exe	83
PID 940 wrote to memory of 5008	940	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3868f12735f9bf03e8f9bee604b335fa_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:940
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3868f12735f9bf03e8f9bee604b335fa_JaffaCakes118.dll,#1
  2⤵
  PID:5008
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5008 -s 620
    3⤵
    - Program crash
    PID:2436

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5008 -ip 5008
1⤵
PID:5016