3fb57a8106f88bdb229ee6a631fda559fa68ad9583b015df4f7b9264b2779862

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
11/07/2024, 09:23

Target

388d3321948d6045643ef120c18e4f4a_JaffaCakes118.dll
Size

268KB
MD5

388d3321948d6045643ef120c18e4f4a
SHA1

c9cf7a2e0368f604e8fb93b27cac6b9a3e6a833a
SHA256

3fb57a8106f88bdb229ee6a631fda559fa68ad9583b015df4f7b9264b2779862
SHA512

90850b8cb06b5bde97a293b1f8ea86473291b10c32080a3addb4aa67527e597a4378fa3fa1b58a90f52a80b0af82b7d75e8b194142738dd6c02013ca50ff4ca7
SSDEEP

6144:Ekd9CGvei1leiNKxuSzga8IvLJatCf0ZowHDuQMJopHJw1BD7:EwFv1/KcLyItC8ZowHNJpp4D7

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3172	1152	WerFault.exe	83

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1152	rundll32.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
1152	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2540 wrote to memory of 1152	2540	rundll32.exe	83
PID 2540 wrote to memory of 1152	2540	rundll32.exe	83
PID 2540 wrote to memory of 1152	2540	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\388d3321948d6045643ef120c18e4f4a_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2540
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\388d3321948d6045643ef120c18e4f4a_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:1152
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1152 -s 636
    3⤵
    - Program crash
    PID:3172

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 1152 -ip 1152
1⤵
PID:1940

memory/1152-0-0x0000000013140000-0x000000001322F000-memory.dmp

Filesize
956KB

Download
memory/1152-1-0x0000000000970000-0x0000000000971000-memory.dmp

Filesize
4KB

Download
memory/1152-2-0x0000000000990000-0x0000000000991000-memory.dmp

Filesize
4KB

Download
memory/1152-3-0x0000000013140000-0x000000001322F000-memory.dmp

Filesize
956KB

Download
memory/1152-4-0x0000000000970000-0x0000000000971000-memory.dmp

Filesize
4KB

Download
memory/1152-5-0x0000000000990000-0x0000000000991000-memory.dmp

Filesize
4KB

Download