254ecc1b0a1839a7c52dee81e9f998f26830b85f15f2e55e84fcf017d5427497

Analysis

max time kernel
93s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
11/07/2024, 14:38

Target

398a37d9fb84314ffbfb233e7fa9b73a_JaffaCakes118.dll
Size

73KB
MD5

398a37d9fb84314ffbfb233e7fa9b73a
SHA1

f7c515c1cdf3baab9ef3c3277f33d77c046f64bd
SHA256

254ecc1b0a1839a7c52dee81e9f998f26830b85f15f2e55e84fcf017d5427497
SHA512

811a663dc1f5a4c623701788cb73c35c4a550f9cfbd9441cca1acdc99e68998e873eea9604e946e7bd0e24710062b8bfe183782195572c310fd00a5eba5e3111
SSDEEP

1536:Sjjl3nwzSuOqBubw/WgT6zMKAOK2lCWcQajhRuv:C5UOq0ukgOK2l7aFQv

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3604	448	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 516 wrote to memory of 448	516	rundll32.exe	83
PID 516 wrote to memory of 448	516	rundll32.exe	83
PID 516 wrote to memory of 448	516	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\398a37d9fb84314ffbfb233e7fa9b73a_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:516
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\398a37d9fb84314ffbfb233e7fa9b73a_JaffaCakes118.dll,#1
  2⤵
  PID:448
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 448 -s 600
    3⤵
    - Program crash
    PID:3604

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 448 -ip 448
1⤵
PID:1936