945f5269c077f49ea221e54cca2d3635704336a72240d869a77bbdb796cb2e7c

Analysis

max time kernel
92s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
11/07/2024, 16:17

Target

39db4db5992df124f139e4bfb940b9a4_JaffaCakes118.dll
Size

1.7MB
MD5

39db4db5992df124f139e4bfb940b9a4
SHA1

5eaba4919971c09264ac50018b61dc276fb6b709
SHA256

945f5269c077f49ea221e54cca2d3635704336a72240d869a77bbdb796cb2e7c
SHA512

a277babfafe15fe19ea35435bb471a29475d35a6cd5a722082d6e4ffa0786b059534e01f2578fa7ef5688c24efb82ae2c2c38a70dd086d09fe853778357e332f
SSDEEP

24576:2R3XdK55EIK281H2ijFi98NrwnR9vW1T/GKILEhIEaFZAeVCVmsr8tsXGPKQGB3c:2ZdjXXVxiKNknR9vWhGyevNS

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4960	1952	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2632 wrote to memory of 1952	2632	rundll32.exe	83
PID 2632 wrote to memory of 1952	2632	rundll32.exe	83
PID 2632 wrote to memory of 1952	2632	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\39db4db5992df124f139e4bfb940b9a4_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2632
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\39db4db5992df124f139e4bfb940b9a4_JaffaCakes118.dll,#1
  2⤵
  PID:1952
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1952 -s 568
    3⤵
    - Program crash
    PID:4960

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1952 -ip 1952
1⤵
PID:3776