45adc49aa6c404e449ec1c2a9a6b60076b912ca580e72e06745b26ab35b3350a

Analysis

max time kernel
94s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
12/07/2024, 01:42

Target

3b8aa5e57117302a74fcd9f88876a4f0_JaffaCakes118.dll
Size

180KB
MD5

3b8aa5e57117302a74fcd9f88876a4f0
SHA1

af78b720ce4b37a9c4f65b2dbb43d54c0c02f49f
SHA256

45adc49aa6c404e449ec1c2a9a6b60076b912ca580e72e06745b26ab35b3350a
SHA512

716e372f9f6b0b10d1d731e41eeccb260762cdf7d0140b2442c1fb4e4246df94beb165605c91664ff9e15f0d1c3d814e3077901a876f4b0cc5744e9e8ed6ca0a
SSDEEP

1536:+vYWQhY/8rbNjDTUc6sz94QAClo8J78RAQjuG:+umoCkkClo8uRAQS

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2580	1472	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4100 wrote to memory of 1472	4100	rundll32.exe	83
PID 4100 wrote to memory of 1472	4100	rundll32.exe	83
PID 4100 wrote to memory of 1472	4100	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3b8aa5e57117302a74fcd9f88876a4f0_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4100
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3b8aa5e57117302a74fcd9f88876a4f0_JaffaCakes118.dll,#1
  2⤵
  PID:1472
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1472 -s 544
    3⤵
    - Program crash
    PID:2580

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1472 -ip 1472
1⤵
PID:1068

memory/1472-0-0x0000000010000000-0x000000001002D000-memory.dmp

Filesize
180KB

Download