d9e4c6e46ba45d48b94b6895a655f4e90407be0735e4551b0aa91912e8acfd82

Analysis

max time kernel
91s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
13/07/2024, 16:12

Target

4268315a030350b81dfebcecfe859870_JaffaCakes118.dll
Size

72KB
MD5

4268315a030350b81dfebcecfe859870
SHA1

2ce6e1f327f43eb131ad561567e21bf6fdcb168d
SHA256

d9e4c6e46ba45d48b94b6895a655f4e90407be0735e4551b0aa91912e8acfd82
SHA512

1c2f242a810afac388c0783c7664678886eada8c07411c8c07702c286ef73c43942f3616d95bc8579c738acbfc0d6731fa6968e27e60a22cbb1c755fb6d286e5
SSDEEP

1536:Sjjl3nwzSuOqBubw/WgT6zMKAOK2lCWcQajhRuP:C5UOq0ukgOK2l7aFQP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3768	324	WerFault.exe	85

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3500 wrote to memory of 324	3500	rundll32.exe	85
PID 3500 wrote to memory of 324	3500	rundll32.exe	85
PID 3500 wrote to memory of 324	3500	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4268315a030350b81dfebcecfe859870_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3500
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4268315a030350b81dfebcecfe859870_JaffaCakes118.dll,#1
  2⤵
  PID:324
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 324 -s 600
    3⤵
    - Program crash
    PID:3768

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 324 -ip 324
1⤵
PID:2380