18aeec3734ef1b5752131b18baf17fe67ec7a64ab66ac993c39b6de9c951774d

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
11/07/2024, 16:27

Target

39e38ce2d24172815b4132606faae87d_JaffaCakes118.dll
Size

28KB
MD5

39e38ce2d24172815b4132606faae87d
SHA1

62daf097949b89545de2c79ca14f0bbf3161e75a
SHA256

18aeec3734ef1b5752131b18baf17fe67ec7a64ab66ac993c39b6de9c951774d
SHA512

03729b53b27cd35a71b62554048b4fff4c5e99fe8201214920bb0349d08118820ac2bb382546da93b91ae2a80cf9f55c788d9a32193b2d85872ec64d08b20a20
SSDEEP

384:MHrHFzrX6jtIlLqiDhYz8djAm0ShD8nEgaVBCeCdy9kjQKLNXj79Glh3z1Ihl:MLlzrGuIitYzWEFANmty9+BNXj7slBol

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1480	1896	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5004 wrote to memory of 1896	5004	rundll32.exe	82
PID 5004 wrote to memory of 1896	5004	rundll32.exe	82
PID 5004 wrote to memory of 1896	5004	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\39e38ce2d24172815b4132606faae87d_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5004
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\39e38ce2d24172815b4132606faae87d_JaffaCakes118.dll,#1
  2⤵
  PID:1896
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1896 -s 580
    3⤵
    - Program crash
    PID:1480

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1896 -ip 1896
1⤵
PID:3460

memory/1896-0-0x0000000010000000-0x0000000010010000-memory.dmp

Filesize
64KB

Download