c9b4685185e0f998c9389bb1756c5e741c21cbbbce78fd33b0c4d44b49de5f5e

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
13/07/2024, 15:08

Target

4232fca300d7e37eaccf990a40fe9c83_JaffaCakes118.dll
Size

244KB
MD5

4232fca300d7e37eaccf990a40fe9c83
SHA1

227e5ed419498f04f27bc0840f0134e74a22e826
SHA256

c9b4685185e0f998c9389bb1756c5e741c21cbbbce78fd33b0c4d44b49de5f5e
SHA512

eefabdbc62fc1eb2db001ae525516dccf8226abf4f43d5b114dfe8cc31c46b920c69bb9a5594c65bee20ae35e41cbd1d00ce07738084c906abcf2e25caf6755a
SSDEEP

6144:a6Ib0YtxWuar6klk+bLOsbzSjlsyhGOotpd0rFOYn:Mb0YtUuKxkmisbzSpsyhM4

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3620	400	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3224 wrote to memory of 400	3224	rundll32.exe	83
PID 3224 wrote to memory of 400	3224	rundll32.exe	83
PID 3224 wrote to memory of 400	3224	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4232fca300d7e37eaccf990a40fe9c83_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3224
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4232fca300d7e37eaccf990a40fe9c83_JaffaCakes118.dll,#1
  2⤵
  PID:400
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 400 -s 572
    3⤵
    - Program crash
    PID:3620

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 400 -ip 400
1⤵
PID:3504

memory/400-0-0x0000000010000000-0x00000000100F4000-memory.dmp

Filesize
976KB

Download