eb87737df62fa325fd5d97e0bcc266ae240759ca180cbd22bdad3d98946e9b73

Analysis

max time kernel
93s
max time network
132s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
11/07/2024, 17:47

Target

3a24f7925c13607f090b87661d038fff_JaffaCakes118.dll
Size

126KB
MD5

3a24f7925c13607f090b87661d038fff
SHA1

8144abc3e574b9c0387347ff1a54e97f5cd521f5
SHA256

eb87737df62fa325fd5d97e0bcc266ae240759ca180cbd22bdad3d98946e9b73
SHA512

3f0099f71287a5f4846b0f8867f463f09697220391a65ea89d6677493a401402cbbfb92286a58460286a14c6a9c9cf7e73e94f3e135796437f2f1506f556e0d7
SSDEEP

3072:P/GYCn9x2obI8t1ZVHR0lNnWVIRdYxSgK/:XGYC9xJIw1ZhOPnt0xSgK/

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
628	860	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 780 wrote to memory of 860	780	rundll32.exe	83
PID 780 wrote to memory of 860	780	rundll32.exe	83
PID 780 wrote to memory of 860	780	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3a24f7925c13607f090b87661d038fff_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:780
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3a24f7925c13607f090b87661d038fff_JaffaCakes118.dll,#1
  2⤵
  PID:860
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 860 -s 572
    3⤵
    - Program crash
    PID:628

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 860 -ip 860
1⤵
PID:3532