72bc8fe90c32c6fa087c5277276122763a43776c5992ee5a6782d382035250b5

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
14/07/2024, 22:54

Target

4721f4eaae10f870585a01ee9c58abc6_JaffaCakes118.dll
Size

29KB
MD5

4721f4eaae10f870585a01ee9c58abc6
SHA1

1f699b4719a532082954a40ad502664167de0fb1
SHA256

72bc8fe90c32c6fa087c5277276122763a43776c5992ee5a6782d382035250b5
SHA512

48c1c843cbf13b2d1b8c9e69f8ab6d4787bf251dd2c29cba9edb8d7a4b283c309b913f384ea1be77721ebfb7fea99dc465c8d1b70399c9d9856ab1c42c13e643
SSDEEP

192:UP8OZb+4+GAPYpViCeD+tcD3uBBQ6PRQkirW3UwBB1jf:Sbb+PGAPYHKyauBBQARQkoW3UwXF

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4252	1644	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1116 wrote to memory of 1644	1116	rundll32.exe	83
PID 1116 wrote to memory of 1644	1116	rundll32.exe	83
PID 1116 wrote to memory of 1644	1116	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4721f4eaae10f870585a01ee9c58abc6_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1116
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4721f4eaae10f870585a01ee9c58abc6_JaffaCakes118.dll,#1
  2⤵
  PID:1644
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1644 -s 556
    3⤵
    - Program crash
    PID:4252

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1644 -ip 1644
1⤵
PID:4812

memory/1644-0-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download
memory/1644-1-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download