755491ca34768a301132e480e3d31f8a3958e7f7676b83c6d201a05f9c744f20

Analysis

max time kernel
93s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
13/07/2024, 12:31

Target

41ab8b3514710b1cc6272e6cd35af86e_JaffaCakes118.dll
Size

52KB
MD5

41ab8b3514710b1cc6272e6cd35af86e
SHA1

e503c2104405fb455300f7b4e0f37a5382e79117
SHA256

755491ca34768a301132e480e3d31f8a3958e7f7676b83c6d201a05f9c744f20
SHA512

ce9b9bdee9b3b6eb482a23b5ccc96fd5bf0852120720a06648619660371bc8e3db67a4dca7b9ef8840cd761451dd1bf7728f3b6cb093740eff8f6045de2b7da8
SSDEEP

768:QIZ4J/ZkADwsiU6Siykx/kVwr5P1n4G0517I9+Xo9F/n:QIZ4tF8siU6S1k1iwF110517+Cobn

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1512	2568	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4968 wrote to memory of 2568	4968	rundll32.exe	83
PID 4968 wrote to memory of 2568	4968	rundll32.exe	83
PID 4968 wrote to memory of 2568	4968	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\41ab8b3514710b1cc6272e6cd35af86e_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4968
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\41ab8b3514710b1cc6272e6cd35af86e_JaffaCakes118.dll,#1
  2⤵
  PID:2568
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2568 -s 580
    3⤵
    - Program crash
    PID:1512

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2568 -ip 2568
1⤵
PID:5100

memory/2568-0-0x0000000000740000-0x0000000000741000-memory.dmp

Filesize
4KB

Download