d733e8943431d47b51780fae083db7f2eb6c9eedd03c4e863ff6fab92d015316

Analysis

max time kernel
93s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
11/07/2024, 12:59

Target

3936dbc944b5e42e84c2d975af7b3782_JaffaCakes118.dll
Size

129KB
MD5

3936dbc944b5e42e84c2d975af7b3782
SHA1

9f064fc4e44086fd60fb76fe1fe6d77d49017a08
SHA256

d733e8943431d47b51780fae083db7f2eb6c9eedd03c4e863ff6fab92d015316
SHA512

c71724290d2eabf1e0291dce666cba525b673bb4652a53bbbd8c356fd8fb1ff36dbf2648173570ffa6d4b7835f23572d3c60704572858ced4681fa972ee84675
SSDEEP

3072:Oo/C3Jro/r8TvjgFCBrzjE4I0uWREuoGww+YHOL5PFn0wcccccccc:zd/ATMFCe1l6Eu7wCH0PFn0wcccccccc

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1864	624	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 840 wrote to memory of 624	840	rundll32.exe	83
PID 840 wrote to memory of 624	840	rundll32.exe	83
PID 840 wrote to memory of 624	840	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3936dbc944b5e42e84c2d975af7b3782_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:840
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3936dbc944b5e42e84c2d975af7b3782_JaffaCakes118.dll,#1
  2⤵
  PID:624
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 624 -s 544
    3⤵
    - Program crash
    PID:1864

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 624 -ip 624
1⤵
PID:1488