0490c13053e9a8443d2b7cf186f0ac6dfaabb3fda9596f96e16128e9d1792118

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
12/07/2024, 01:13

Target

3b736452b26d4436db045c91d9689088_JaffaCakes118.dll
Size

204KB
MD5

3b736452b26d4436db045c91d9689088
SHA1

b364f420ca62a1f9ce49d41520db5804e43c1b86
SHA256

0490c13053e9a8443d2b7cf186f0ac6dfaabb3fda9596f96e16128e9d1792118
SHA512

afd71e2c16b13579689c4f60f480655e49b49213b17da5e2d81ab4c617b814c07515b938e02f2c83f3b9189263144ee669f2caf6b0763ca1f5b422aa091d163d
SSDEEP

3072:4L4VDxk7xWamNdyDIRzHJc0nJ2VbWMk7V7wBkSqcmRlvmI0qHhcO5VHteGHzksws:odJv0Jl7W84swYCA

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4188	760	WerFault.exe	83
4444	760	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3180 wrote to memory of 760	3180	rundll32.exe	83
PID 3180 wrote to memory of 760	3180	rundll32.exe	83
PID 3180 wrote to memory of 760	3180	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3b736452b26d4436db045c91d9689088_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3180
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3b736452b26d4436db045c91d9689088_JaffaCakes118.dll,#1
  2⤵
  PID:760
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 760 -s 592
    3⤵
    - Program crash
    PID:4188
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 760 -s 828
    3⤵
    - Program crash
    PID:4444

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 760 -ip 760
1⤵
PID:4884

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 760 -ip 760
1⤵
PID:5104