bcde34066569711eb3104aefedcf75cf93d7b818847b4cd57ccaa541bc550b27

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
11/07/2024, 19:31

Target

3a73c3855f0a35db136394f0993f5a61_JaffaCakes118.dll
Size

34KB
MD5

3a73c3855f0a35db136394f0993f5a61
SHA1

1bc17ca8de4ab0a7b026ceca22485107639ef465
SHA256

bcde34066569711eb3104aefedcf75cf93d7b818847b4cd57ccaa541bc550b27
SHA512

da444e0688593a5cd11939a70880f590ce51614b420b06389e6ba05b15441c11cdb388901a73f069835833472caf4f344b05260196ce280734fb7128e2e3b447
SSDEEP

768:Grw22Cv+j2+/dJyI/B+AHy2mIL0qt1fnXZ1l5wE+eg:Gh2w+BdQIDHyZIL0oVXZvKHeg

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2572	3952	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2576 wrote to memory of 3952	2576	rundll32.exe	83
PID 2576 wrote to memory of 3952	2576	rundll32.exe	83
PID 2576 wrote to memory of 3952	2576	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3a73c3855f0a35db136394f0993f5a61_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2576
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3a73c3855f0a35db136394f0993f5a61_JaffaCakes118.dll,#1
  2⤵
  PID:3952
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3952 -s 580
    3⤵
    - Program crash
    PID:2572

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3952 -ip 3952
1⤵
PID:3564

memory/3952-0-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/3952-1-0x0000000002C40000-0x0000000002C41000-memory.dmp

Filesize
4KB

Download