2a020d521b2de2f9f4cd14457b635e6f2613654a14533e4dba94edc12c36ef5c

Analysis

max time kernel
144s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
11-07-2024 09:00

Target

387c545d497e55d0fd536f1edd81ed52_JaffaCakes118.dll
Size

2KB
MD5

387c545d497e55d0fd536f1edd81ed52
SHA1

756d6c70a6a329b0d81f1c52eec076b2fccb4619
SHA256

2a020d521b2de2f9f4cd14457b635e6f2613654a14533e4dba94edc12c36ef5c
SHA512

4b046cc53c3ae14826a5915c7cfb1f5e3d3897c95b60cc3d5f01e6f41348c947d98e2cb5ce602f17c1fd9408ffb6d3d3833f3eaf22019de102cb8512fdaec61e

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4300	2256	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4544 wrote to memory of 2256	4544	rundll32.exe	83
PID 4544 wrote to memory of 2256	4544	rundll32.exe	83
PID 4544 wrote to memory of 2256	4544	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\387c545d497e55d0fd536f1edd81ed52_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4544
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\387c545d497e55d0fd536f1edd81ed52_JaffaCakes118.dll,#1
  2⤵
  PID:2256
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2256 -s 548
    3⤵
    - Program crash
    PID:4300

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2256 -ip 2256
1⤵
PID:1008

memory/2256-0-0x000000007C340000-0x000000007C397000-memory.dmp

Filesize
348KB

Download