b2339993d190eda649ad0981cab8a150a7770630b9ef361d76b18e16506af8ea

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
13-07-2024 11:56

Target

418f3139dc1c52b3c2c6cd973c2b189e_JaffaCakes118.dll
Size

68KB
MD5

418f3139dc1c52b3c2c6cd973c2b189e
SHA1

2c96484e6ab45b1a3bcecf3810d235248988c185
SHA256

b2339993d190eda649ad0981cab8a150a7770630b9ef361d76b18e16506af8ea
SHA512

e9c98892155e5ba45aef5510de9ed8cebfd997c26ff60aa7ea7f1b47c39f6a9c20bfb93c650925a72f3c9f648777fa220ed423a9b69ae8d9d561d835f73435d6
SSDEEP

1536:cb0JAvAjr8tnyaGisxp4KOF5UTvSDHXtNkXn/Y5AtWXKQI6Pwn5:cYCvAjotyaGiisqTKrvkXQ5AtW/5Pw5

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1844	2036	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1728 wrote to memory of 2036	1728	rundll32.exe	83
PID 1728 wrote to memory of 2036	1728	rundll32.exe	83
PID 1728 wrote to memory of 2036	1728	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\418f3139dc1c52b3c2c6cd973c2b189e_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1728
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\418f3139dc1c52b3c2c6cd973c2b189e_JaffaCakes118.dll,#1
  2⤵
  PID:2036
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2036 -s 540
    3⤵
    - Program crash
    PID:1844

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2036 -ip 2036
1⤵
PID:4988

memory/2036-0-0x0000000010000000-0x000000001002C000-memory.dmp

Filesize
176KB

Download