b8876ee48ac27f33e57d5c3cc3e28e0bceea6a2d2d4463b58e0f393fbd4f6ae1

Analysis

max time kernel
94s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
13/07/2024, 01:05

Target

3f977b01dbb7b3121d8fa8b72c9d99e2_JaffaCakes118.dll
Size

244KB
MD5

3f977b01dbb7b3121d8fa8b72c9d99e2
SHA1

804ed9eac6b6952b8f685ebca6e80a1d683bb150
SHA256

b8876ee48ac27f33e57d5c3cc3e28e0bceea6a2d2d4463b58e0f393fbd4f6ae1
SHA512

afe9f86dfb59bbada6bb8d979b69e9bb7a822cb20bff4d178028de003716523551875af75414793e75494f379bf640f30397f329ff98021497124e0c6c807944
SSDEEP

3072:kYS7nCcolduuT8Cy/8EsmxEsmxEsmxEsmPYS7nCcolduuT8Cy/V:67Ing8ZgZgZgZ+7IngV

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
404	1692	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3496 wrote to memory of 1692	3496	rundll32.exe	83
PID 3496 wrote to memory of 1692	3496	rundll32.exe	83
PID 3496 wrote to memory of 1692	3496	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3f977b01dbb7b3121d8fa8b72c9d99e2_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3496
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3f977b01dbb7b3121d8fa8b72c9d99e2_JaffaCakes118.dll,#1
  2⤵
  PID:1692
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1692 -s 612
    3⤵
    - Program crash
    PID:404

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1692 -ip 1692
1⤵
PID:4856