b9aa193cb889d5b91a0da706737e7bd2b1d87228de4e77fe50836a41aa7d4e18

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
12/07/2024, 04:35

Target

3c00bc0343dc19c6f0a152d039bc2e8b_JaffaCakes118.dll
Size

43KB
MD5

3c00bc0343dc19c6f0a152d039bc2e8b
SHA1

8766e2a69157f8120ec7bac484029f37654877bc
SHA256

b9aa193cb889d5b91a0da706737e7bd2b1d87228de4e77fe50836a41aa7d4e18
SHA512

9bfb260d9e1b24fdd20333d91b2a077c96928ea2306f83f0a41a4f575a86b768d970b6fb606d1c170f123e5fb13fbb8f8c6e231a8859838638a3678e6bc6ffc8
SSDEEP

768:CQ1RnoE8dwDK9DIR6WS6nKDDsfsNw4GnhdV9o4l:CwSKhfKvo75V9

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2088	3568	WerFault.exe	83
4272	3568	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3004 wrote to memory of 3568	3004	rundll32.exe	83
PID 3004 wrote to memory of 3568	3004	rundll32.exe	83
PID 3004 wrote to memory of 3568	3004	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3c00bc0343dc19c6f0a152d039bc2e8b_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3004
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3c00bc0343dc19c6f0a152d039bc2e8b_JaffaCakes118.dll,#1
  2⤵
  PID:3568
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3568 -s 592
    3⤵
    - Program crash
    PID:2088
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3568 -s 588
    3⤵
    - Program crash
    PID:4272

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3568 -ip 3568
1⤵
PID:1724

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 3568 -ip 3568
1⤵
PID:3560

memory/3568-0-0x0000000000407000-0x0000000000409000-memory.dmp

Filesize
8KB

Download
memory/3568-1-0x0000000000400000-0x00000000004D7000-memory.dmp

Filesize
860KB

Download