ad07f0bc934d90322e44a261c3b062cfede77c3a7f4913d51a78dd9436d29b79

Analysis

max time kernel
92s
max time network
101s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
13/07/2024, 21:24

Target

4365bf4b9b13356a58afde1d161742d7_JaffaCakes118.dll
Size

83KB
MD5

4365bf4b9b13356a58afde1d161742d7
SHA1

cbcca7255daf85b51ec87c99503a2b31e85aa84e
SHA256

ad07f0bc934d90322e44a261c3b062cfede77c3a7f4913d51a78dd9436d29b79
SHA512

73fc5ff6b79b954889c9b4aeab2c640351a65d66ec5fe536603443d20f860e55a1e385e9867c4715336c611507ebd282a74672f0c2d885ed45c461f1db99ccc4
SSDEEP

1536:pL+sGD81j+U6abMt4bERgmLwJGpGGClbvNxIyQFWj8cKnP6:vGW6LbGmLKGg/lb7YoZKP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2952	3996	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3176 wrote to memory of 3996	3176	rundll32.exe	83
PID 3176 wrote to memory of 3996	3176	rundll32.exe	83
PID 3176 wrote to memory of 3996	3176	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4365bf4b9b13356a58afde1d161742d7_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3176
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4365bf4b9b13356a58afde1d161742d7_JaffaCakes118.dll,#1
  2⤵
  PID:3996
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3996 -s 560
    3⤵
    - Program crash
    PID:2952

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 3996 -ip 3996
1⤵
PID:1628

memory/3996-0-0x0000000010000000-0x0000000010028000-memory.dmp

Filesize
160KB

Download