7df7ebf90ee2c670fdbbbecc1a206f3eb9b090580c18897e61bf98d2ee8bcf1b

Analysis

max time kernel
92s
max time network
122s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
12/07/2024, 12:26

Target

3d5e3b47c42b1c6078badfae33aa8326_JaffaCakes118.dll
Size

679KB
MD5

3d5e3b47c42b1c6078badfae33aa8326
SHA1

380932187626ab9f61be4fc4cdc395f80192c954
SHA256

7df7ebf90ee2c670fdbbbecc1a206f3eb9b090580c18897e61bf98d2ee8bcf1b
SHA512

e5644a4f24f611e136388e7619879967d248475c07713c88516758d8e3b910171082ad9eebe1d65c2dd06ba5cf2af0826b50a5855428ed143ae188c4fc9f4df0
SSDEEP

12288:se4x/nF+8PW5AJLoS8e9ub6Kt/idEuzgUW9NPdMKjF5MbHvt6rO+JXodWI:z6/Y8PW5AJLF8Lb6ShuzMDPdMVv4rO+j

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2340	2388	WerFault.exe	86

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2388	rundll32.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
2388	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3596 wrote to memory of 2388	3596	rundll32.exe	86
PID 3596 wrote to memory of 2388	3596	rundll32.exe	86
PID 3596 wrote to memory of 2388	3596	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3d5e3b47c42b1c6078badfae33aa8326_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3596
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3d5e3b47c42b1c6078badfae33aa8326_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:2388
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2388 -s 636
    3⤵
    - Program crash
    PID:2340

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 2388 -ip 2388
1⤵
PID:3688

memory/2388-0-0x00000000007B0000-0x00000000007B1000-memory.dmp

Filesize
4KB

Download
memory/2388-1-0x0000000013140000-0x00000000131F0000-memory.dmp

Filesize
704KB

Download