463eb9619df56d148c7c4fedaca233852a29c57c78c8089f6f9b06c6c8419200

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
13/07/2024, 21:25

Target

4366bc38eb5f39b8e0999416faac5be4_JaffaCakes118.dll
Size

84KB
MD5

4366bc38eb5f39b8e0999416faac5be4
SHA1

d49902637bec67a5fceb3b8df5d992f21ad088bf
SHA256

463eb9619df56d148c7c4fedaca233852a29c57c78c8089f6f9b06c6c8419200
SHA512

1d29e1cfc79f9b5efdb4380c4eb224c15b0032ae317657d854aebfb895c51615d0473d8a7af46e472709dcf7b33675a783f8b11a092c9a709ad113a426968102
SSDEEP

768:FR3pCP49aRu31KmwnkTYQ1z6n4SFb37+wSq5hbMiBNdmbwItYdQciv7h:FR3p0GaRad1Yq6n4SFb7+ar3daxtYy7

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3952	2092	WerFault.exe	83
3504	2092	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1708 wrote to memory of 2092	1708	rundll32.exe	83
PID 1708 wrote to memory of 2092	1708	rundll32.exe	83
PID 1708 wrote to memory of 2092	1708	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4366bc38eb5f39b8e0999416faac5be4_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1708
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4366bc38eb5f39b8e0999416faac5be4_JaffaCakes118.dll,#1
  2⤵
  PID:2092
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2092 -s 544
    3⤵
    - Program crash
    PID:3952
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2092 -s 860
    3⤵
    - Program crash
    PID:3504

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2092 -ip 2092
1⤵
PID:3644

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 2092 -ip 2092
1⤵
PID:4308

memory/2092-0-0x0000000010000000-0x0000000010017000-memory.dmp

Filesize
92KB

Download