6da5aa385b7fefc833782a084c8eb5ed6d1d01d1c585652aae30247ec32e46b1

Analysis

max time kernel
93s
max time network
105s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
14/07/2024, 05:05

Target

446bd5b9a1aa531982641fb9d154e105_JaffaCakes118.dll
Size

47KB
MD5

446bd5b9a1aa531982641fb9d154e105
SHA1

cda48201c499ac0e245c69dae16a2ded8f577c66
SHA256

6da5aa385b7fefc833782a084c8eb5ed6d1d01d1c585652aae30247ec32e46b1
SHA512

9b18e2c00e2cc9bb513d4e6e8e4f378fcefe69d34d850a49a2dab1e923363501fac0d744a3e2619a2858a815e67e05068c77b74b1575830a232610ff06ccb888
SSDEEP

768:w4ixFYqQlVuDRubmpKWHPb+uV6kH3OcOhnvxbSblDSODxelBCay6:/0YLVuduhS+sFXsnpWb9/DxelPZ

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3180	3188	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2868 wrote to memory of 3188	2868	rundll32.exe	83
PID 2868 wrote to memory of 3188	2868	rundll32.exe	83
PID 2868 wrote to memory of 3188	2868	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\446bd5b9a1aa531982641fb9d154e105_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2868
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\446bd5b9a1aa531982641fb9d154e105_JaffaCakes118.dll,#1
  2⤵
  PID:3188
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3188 -s 596
    3⤵
    - Program crash
    PID:3180

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 3188 -ip 3188
1⤵
PID:4748

memory/3188-0-0x0000000010000000-0x0000000010021000-memory.dmp

Filesize
132KB

Download