c5c74a3e56f443204b56ad5835ea1fb23f2898744ade6a4a1756d7a366ad5607

Analysis

max time kernel
92s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
11/07/2024, 11:26

Target

38ec18d7c140565632027f2691df2775_JaffaCakes118.dll
Size

72KB
MD5

38ec18d7c140565632027f2691df2775
SHA1

1750ea8eec08352ba956d61db846385f6d95cc30
SHA256

c5c74a3e56f443204b56ad5835ea1fb23f2898744ade6a4a1756d7a366ad5607
SHA512

522e0e0260daf6ade56718c59eff837ecb34f78e6cebeda28a2d44a518f47c0bcd4ba81ebc880dd244a59d8247fe84380e4560c276cc4a0f6a8cc046a2f68f05
SSDEEP

1536:Sjjl3nwzSuOqBubw/WgT6zMKAOK2lCWcQajhRuv:C5UOq0ukgOK2l7aFQv

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1868	2636	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1492 wrote to memory of 2636	1492	rundll32.exe	83
PID 1492 wrote to memory of 2636	1492	rundll32.exe	83
PID 1492 wrote to memory of 2636	1492	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\38ec18d7c140565632027f2691df2775_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1492
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\38ec18d7c140565632027f2691df2775_JaffaCakes118.dll,#1
  2⤵
  PID:2636
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2636 -s 600
    3⤵
    - Program crash
    PID:1868

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2636 -ip 2636
1⤵
PID:3400