0e489fcb91110754fac1bc1f80f9e1091c9983629bdb4348b926ce8e1232ae98

Analysis

max time kernel
92s
max time network
93s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
12/07/2024, 04:08

Target

3bef39d4787d31bc2d198d71421a3909_JaffaCakes118.dll
Size

96KB
MD5

3bef39d4787d31bc2d198d71421a3909
SHA1

2debe058c9220341df80efab9f281d8f29153423
SHA256

0e489fcb91110754fac1bc1f80f9e1091c9983629bdb4348b926ce8e1232ae98
SHA512

a0325b2c171004b71876d9f9daa8e28d8f5e4613bbaafe2874106655aef6bbed8193618389c3cbef6b100e45a0d5d9e6708c93b29242d7867c9a1531de5ed46f
SSDEEP

3072:W44eYhg3IeJHxkJMH/wWipXKyihFABD4ypnu:b447jxKBD4yRu

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2512	2636	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3364 wrote to memory of 2636	3364	rundll32.exe	83
PID 3364 wrote to memory of 2636	3364	rundll32.exe	83
PID 3364 wrote to memory of 2636	3364	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3bef39d4787d31bc2d198d71421a3909_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3364
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3bef39d4787d31bc2d198d71421a3909_JaffaCakes118.dll,#1
  2⤵
  PID:2636
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2636 -s 544
    3⤵
    - Program crash
    PID:2512

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2636 -ip 2636
1⤵
PID:4860

memory/2636-0-0x0000000010000000-0x000000001002F000-memory.dmp

Filesize
188KB

Download