4a4888be9e4f3fe3f09f860b2d0d12f555746a8502e83fe86beea1e2ecb0eb96

Analysis

max time kernel
95s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
12/07/2024, 18:11

Target

3e59d836bd0a3581316d34ecf2b5ee51_JaffaCakes118.dll
Size

62KB
MD5

3e59d836bd0a3581316d34ecf2b5ee51
SHA1

736692694a9025d5f2b1ace28c19784483c41fde
SHA256

4a4888be9e4f3fe3f09f860b2d0d12f555746a8502e83fe86beea1e2ecb0eb96
SHA512

0d115e022d81eb5960a30249b7307661b7f04618c19504e3ab2eb19973717b4bcb8c60edd9a053e329fb6a30fb8893c6c8e543f154529baa6f2f81c05dd8b12d
SSDEEP

1536:kbk4JSqgtrR1IGMlCwnW8iUZOgYQc25Q+uHFodnQr/2s9jeB:kbk4JSqYrRNMlCwnDirt2i+eoVQrL9jI

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1608	3548	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3952 wrote to memory of 3548	3952	rundll32.exe	83
PID 3952 wrote to memory of 3548	3952	rundll32.exe	83
PID 3952 wrote to memory of 3548	3952	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3e59d836bd0a3581316d34ecf2b5ee51_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3952
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3e59d836bd0a3581316d34ecf2b5ee51_JaffaCakes118.dll,#1
  2⤵
  PID:3548
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3548 -s 580
    3⤵
    - Program crash
    PID:1608

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3548 -ip 3548
1⤵
PID:4680

memory/3548-0-0x0000000010000000-0x000000001001E000-memory.dmp

Filesize
120KB

Download
memory/3548-1-0x0000000002570000-0x00000000025FD000-memory.dmp

Filesize
564KB

Download