e382d63ba9d1c47598075687fe29063e329af355ece7cb211c8a242977e89008

Analysis

max time kernel
92s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
13/07/2024, 05:14

Target

4053339d186dc2c8894efdf150e79782_JaffaCakes118.dll
Size

179KB
MD5

4053339d186dc2c8894efdf150e79782
SHA1

2e1d589cc73265b0a98cf18395dafada3cabed41
SHA256

e382d63ba9d1c47598075687fe29063e329af355ece7cb211c8a242977e89008
SHA512

12417d2bb297bd125849aa08f6dfd4e9e34ee42700d069ef386e8be987dbfab0f1a7b9dc3408ba7c2c120905c9f8aebef073fbba98447bfaf1f9cbaadabfb3a4
SSDEEP

1536:0mHWD0moPF9z6hBbRF7bI2yvyQxEkepabITjSBdtBTLrms15:0mHWD4PvmR62dQq4Bdtx/ms15

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
64	1192	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2908 wrote to memory of 1192	2908	rundll32.exe	83
PID 2908 wrote to memory of 1192	2908	rundll32.exe	83
PID 2908 wrote to memory of 1192	2908	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4053339d186dc2c8894efdf150e79782_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2908
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4053339d186dc2c8894efdf150e79782_JaffaCakes118.dll,#1
  2⤵
  PID:1192
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1192 -s 544
    3⤵
    - Program crash
    PID:64

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 1192 -ip 1192
1⤵
PID:1600

memory/1192-0-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download