976ceae5566c5f77b4d440229d13dc10fe94ec86cfcf6fe4ecc01aad9e4a6aed

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
12/07/2024, 21:35

Target

3ef79824f34e8195c64f57affee25c46_JaffaCakes118.dll
Size

861KB
MD5

3ef79824f34e8195c64f57affee25c46
SHA1

f2be2e070dd522102840767589408400a603f0a5
SHA256

976ceae5566c5f77b4d440229d13dc10fe94ec86cfcf6fe4ecc01aad9e4a6aed
SHA512

9adc24b01875c3458d00b473bc77a599fb4895a4c523c3f728be03e3a199128198f295e165fe1d28427de760de4307716050e06ae92b17bd6f40f547947ed8ca
SSDEEP

24576:feVyyucjuKybpZufCwT+Pr7URqnfhDnEnO01hE:GlYpEf7q5fZEnO

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4736	2860	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4828 wrote to memory of 2860	4828	rundll32.exe	83
PID 4828 wrote to memory of 2860	4828	rundll32.exe	83
PID 4828 wrote to memory of 2860	4828	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3ef79824f34e8195c64f57affee25c46_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4828
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3ef79824f34e8195c64f57affee25c46_JaffaCakes118.dll,#1
  2⤵
  PID:2860
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2860 -s 624
    3⤵
    - Program crash
    PID:4736

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 2860 -ip 2860
1⤵
PID:4064

memory/2860-0-0x0000000000D60000-0x0000000000E71000-memory.dmp

Filesize
1.1MB

Download
memory/2860-1-0x0000000000E5E000-0x0000000000E60000-memory.dmp

Filesize
8KB

Download
memory/2860-2-0x0000000000D60000-0x0000000000E71000-memory.dmp

Filesize
1.1MB

Download
memory/2860-3-0x0000000000D60000-0x0000000000E71000-memory.dmp

Filesize
1.1MB

Download