f44215e86378788e27feae079912f1eec98541a32ecaf6a9ab773c4f8fc06624

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
12/07/2024, 21:33

Target

3ef6b55d621e0b4a81da36711a9b1539_JaffaCakes118.dll
Size

49KB
MD5

3ef6b55d621e0b4a81da36711a9b1539
SHA1

51936f8ecbd704e2dbc76cb29f61a3f8e2a69516
SHA256

f44215e86378788e27feae079912f1eec98541a32ecaf6a9ab773c4f8fc06624
SHA512

665f7e91e7fce8aca12303241284e1e5a162d46fa9eb09d718ba085ffe69ea698881451c189de49c80c8fa0297c1bebf756c09055948990cbbec036a8d8ac743
SSDEEP

768:OG9GQxT+PQbWbgKH0MotN4lbK9hbMt8QC2oUwhjbPNEMdumf+mz/F:OCIPQbovhotN4RkhY6QCPUabVDfHz/F

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3652	2032	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4472 wrote to memory of 2032	4472	rundll32.exe	83
PID 4472 wrote to memory of 2032	4472	rundll32.exe	83
PID 4472 wrote to memory of 2032	4472	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3ef6b55d621e0b4a81da36711a9b1539_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4472
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3ef6b55d621e0b4a81da36711a9b1539_JaffaCakes118.dll,#1
  2⤵
  PID:2032
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2032 -s 596
    3⤵
    - Program crash
    PID:3652

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2032 -ip 2032
1⤵
PID:1380

memory/2032-0-0x0000000010000000-0x0000000010021000-memory.dmp

Filesize
132KB

Download