d2cec748ff277002601f35394c4a1aed0216fd8ba8fa94be10a4b4f9846248c2

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
13/07/2024, 13:42

Target

41e96a853eb5aff92eee691aec4b5514_JaffaCakes118.dll
Size

96KB
MD5

41e96a853eb5aff92eee691aec4b5514
SHA1

1b8af99512c39ac6ab94b8477a056c2ce9991137
SHA256

d2cec748ff277002601f35394c4a1aed0216fd8ba8fa94be10a4b4f9846248c2
SHA512

924e6df1bea28c572b9d35e72169c73b6b0ab94eb6a38dd06ba0ca90fd8e71d5e59e02b98f2faf691335a89130e580721ee098a144ed31f08e82fae96a769b49
SSDEEP

768:lVkimNrTgo766xiA7vMF3Dm60zLibLTlxjTWQ11T7iXqi4rlUI3KbhSdId2npTlI:lvexsA4Fr0YjTW1H4xUI6VSdVlHo

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3768	4180	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2468 wrote to memory of 4180	2468	rundll32.exe	83
PID 2468 wrote to memory of 4180	2468	rundll32.exe	83
PID 2468 wrote to memory of 4180	2468	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\41e96a853eb5aff92eee691aec4b5514_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2468
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\41e96a853eb5aff92eee691aec4b5514_JaffaCakes118.dll,#1
  2⤵
  PID:4180
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4180 -s 680
    3⤵
    - Program crash
    PID:3768

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4180 -ip 4180
1⤵
PID:3688