6154066afd7ee3789c9ba5cf46f5ea705b414473b70ffe611bf2825f7e27074d

Analysis

max time kernel
93s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
13-07-2024 17:43

Target

42b27f842d51a0cb04d53f68b6650001_JaffaCakes118.dll
Size

73KB
MD5

42b27f842d51a0cb04d53f68b6650001
SHA1

c8c7c80853fa5412b3ff85a8883e57a1d7f02479
SHA256

6154066afd7ee3789c9ba5cf46f5ea705b414473b70ffe611bf2825f7e27074d
SHA512

692f3745e51af2d96691ce27a9a19b2df6b0062c5e35cbba62a1e62be10928a921213686b974c072e389d9a3f97a326471daf471997796bc922d5b49c8228a0e
SSDEEP

1536:Sjjl3nwzSuOqBubw/WgT6zMKAOK2lCWcQajhRuv:C5UOq0ukgOK2l7aFQv

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4196	1932	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4024 wrote to memory of 1932	4024	rundll32.exe	83
PID 4024 wrote to memory of 1932	4024	rundll32.exe	83
PID 4024 wrote to memory of 1932	4024	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\42b27f842d51a0cb04d53f68b6650001_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4024
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\42b27f842d51a0cb04d53f68b6650001_JaffaCakes118.dll,#1
  2⤵
  PID:1932
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1932 -s 600
    3⤵
    - Program crash
    PID:4196

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 1932 -ip 1932
1⤵
PID:3844