9274c42c30b94882a6e3935211841ad1afd29f6610d00a37d8487efb2f98ef00

Analysis

max time kernel
148s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
13/07/2024, 20:01

Target

4323a5fc10a32a4aa493f1e45df70e39_JaffaCakes118.dll
Size

116KB
MD5

4323a5fc10a32a4aa493f1e45df70e39
SHA1

a7b88c5418b768c63d2f98f671363fcb0b591dec
SHA256

9274c42c30b94882a6e3935211841ad1afd29f6610d00a37d8487efb2f98ef00
SHA512

a2693bb943e0e2c10d71536af7e5bc29cbb520da9262950026d3da62ae702b484f3d6bc2f2df0ae97b531ca825d61d1fc0de4188638972adee32abcba74da1fc
SSDEEP

3072:elQmnpO2VmZEJCPYVBuYroK9WbMDp54FUJaqu:eOBmjJCPqrIbQkmJa

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1276	1064	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3968 wrote to memory of 1064	3968	rundll32.exe	83
PID 3968 wrote to memory of 1064	3968	rundll32.exe	83
PID 3968 wrote to memory of 1064	3968	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4323a5fc10a32a4aa493f1e45df70e39_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3968
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4323a5fc10a32a4aa493f1e45df70e39_JaffaCakes118.dll,#1
  2⤵
  PID:1064
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1064 -s 632
    3⤵
    - Program crash
    PID:1276

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1064 -ip 1064
1⤵
PID:3644

memory/1064-0-0x0000000010000000-0x000000001005E000-memory.dmp

Filesize
376KB

Download
memory/1064-1-0x0000000010000000-0x000000001005E000-memory.dmp

Filesize
376KB

Download