a2b9c4c3c3a960f1e3610224c3a72c41c0c214c371081c269beed3d4bbfc52a7

Analysis

max time kernel
94s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
14-07-2024 06:00

Target

4499fc3d67b59362a7f5c11960ba5c63_JaffaCakes118.dll
Size

167KB
MD5

4499fc3d67b59362a7f5c11960ba5c63
SHA1

480647158af40dc6fae22523bc63563b48938ee0
SHA256

a2b9c4c3c3a960f1e3610224c3a72c41c0c214c371081c269beed3d4bbfc52a7
SHA512

11cf72908d036297f89d38dc902dea1e2a542954501fead6989f8019f9fb427e6f6c39c66afe34ffa436602090494aead0801c6e87fa257e9cf9662e47a9f696
SSDEEP

3072:cuzKPUNhkuM7LNpU+5hdLk7ydfdlxTxgr+rKqld3TyBTsaCIsB9VI7dOeDWu:cuzFhkuQ3UmhdLou19g0KqfyTsaCo7Aq

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3036	4968	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3308 wrote to memory of 4968	3308	rundll32.exe	83
PID 3308 wrote to memory of 4968	3308	rundll32.exe	83
PID 3308 wrote to memory of 4968	3308	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4499fc3d67b59362a7f5c11960ba5c63_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3308
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4499fc3d67b59362a7f5c11960ba5c63_JaffaCakes118.dll,#1
  2⤵
  PID:4968
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4968 -s 564
    3⤵
    - Program crash
    PID:3036

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4968 -ip 4968
1⤵
PID:2580

memory/4968-0-0x0000000000790000-0x00000000007B5000-memory.dmp

Filesize
148KB

Download