d746f5dcdd69197f670feca824b8933e225e34d3dde5ee240dd6f55b1a49761a

Analysis

max time kernel
93s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
12/07/2024, 12:48

Target

3d71395500e435d10b02cfa086f101d2_JaffaCakes118.dll
Size

42KB
MD5

3d71395500e435d10b02cfa086f101d2
SHA1

313d5cf33c4d0ceef8c3832b34c869818a900eaf
SHA256

d746f5dcdd69197f670feca824b8933e225e34d3dde5ee240dd6f55b1a49761a
SHA512

3bd74af5d1076f658b13d63298e7993aac91982493f2cd47bcbfb402af39206277657526e5995ca85c0ca51f54e638e1462d3093bf3b0913c3014fe5fba4ee37
SSDEEP

768:7v33qUDJ1eRHtGQkYFrMsi1wBYjv4j4WrwKWAU4sKCojE1awI:rdURHt7k8rf+SJwKWAU4yo7w

Score

7^/10

Loads dropped DLL 2 IoCs

pid	Process
1564	rundll32.exe
1564	rundll32.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\ka2nqw.dll	rundll32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3468	1564	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 800 wrote to memory of 1564	800	rundll32.exe	83
PID 800 wrote to memory of 1564	800	rundll32.exe	83
PID 800 wrote to memory of 1564	800	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3d71395500e435d10b02cfa086f101d2_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:800
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3d71395500e435d10b02cfa086f101d2_JaffaCakes118.dll,#1
  2⤵
  - Loads dropped DLL
  - Drops file in System32 directory
  PID:1564
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1564 -s 556
    3⤵
    - Program crash
    PID:3468

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 1564 -ip 1564
1⤵
PID:2308

C:\Windows\SysWOW64\ka2nqw.dll

Filesize
13KB

MD5
3b086283357712b82e79fe7708e6c039

SHA1
0686e28aef8ca4c327b2727e9dbf3a9cf2c528c2

SHA256
ab1e449b5f0113552815226beacf2f7686b3f9089b9efbb271cd15122ab796f0

SHA512
7de81aebbdf19f3040fe026d1277e34e279d8d03a2e7fe9a8173663bb4ea296e033faaf3548fb7d712ee5c064e73fee154ed692cd782d1fa9d2d8232eaf3422a

Download Submit
memory/1564-1-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1564-7-0x0000000000B50000-0x0000000000B5E000-memory.dmp

Filesize
56KB

Download
memory/1564-9-0x0000000000B60000-0x0000000000B61000-memory.dmp

Filesize
4KB

Download
memory/1564-8-0x0000000000B50000-0x0000000000B5E000-memory.dmp

Filesize
56KB

Download
memory/1564-10-0x0000000000B40000-0x0000000000B4A000-memory.dmp

Filesize
40KB

Download