4bcdf33e87247d08526e2231b0ae29aa6f2bf4a2d332e840a7341f7852a4ae8a

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
13/07/2024, 00:10

Target

3f7024091c4d50a48606caf54405519c_JaffaCakes118.dll
Size

8KB
MD5

3f7024091c4d50a48606caf54405519c
SHA1

9775bf8cb804b1a618712b64c638c0711c6893d2
SHA256

4bcdf33e87247d08526e2231b0ae29aa6f2bf4a2d332e840a7341f7852a4ae8a
SHA512

edbe3b9d40899d4551ea1bbd66b09555566410b7ada26d74fc176ed634307b6738f47952d19c14c63271790204983fbf7d8a31807cfc78e4f6d4402a684e7916
SSDEEP

192:eQqN69MiuVsTmbJxtYRPbpu8VxiTkeQAsOiqlaGxzIb06pdmAh:XqN6SiuVK27YRPYCc4A8Db06pUs

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1912	4920	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2512 wrote to memory of 4920	2512	rundll32.exe	83
PID 2512 wrote to memory of 4920	2512	rundll32.exe	83
PID 2512 wrote to memory of 4920	2512	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3f7024091c4d50a48606caf54405519c_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2512
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3f7024091c4d50a48606caf54405519c_JaffaCakes118.dll,#1
  2⤵
  PID:4920
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4920 -s 552
    3⤵
    - Program crash
    PID:1912

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 4920 -ip 4920
1⤵
PID:4396