762d532e066c7676be42d029a09529f2f5b0d04be3ef3cda003d3d13d3e4de5e

Analysis

max time kernel
91s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
14/07/2024, 07:37

Target

44e4cca7588b10da1f4b86143b98aa39_JaffaCakes118.dll
Size

862KB
MD5

44e4cca7588b10da1f4b86143b98aa39
SHA1

9204d8796d38ce9ff8fec1d70f3368f38c0141ee
SHA256

762d532e066c7676be42d029a09529f2f5b0d04be3ef3cda003d3d13d3e4de5e
SHA512

9623bd20baf5e1eb1f052e02208e9f0d88d633cbf64b54d532780479674b7abd8d10dbee251c916e1cf05ecc8d222fbfff50ef85722c218e18788d2a5228012e
SSDEEP

24576:aCaIoN2YZ31DatgwVgEvVNyrSsIfSX8fGWi9tZ:aCaIoN2ms2whvVwOo8fytZ

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
764	2460	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3560 wrote to memory of 2460	3560	rundll32.exe	84
PID 3560 wrote to memory of 2460	3560	rundll32.exe	84
PID 3560 wrote to memory of 2460	3560	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\44e4cca7588b10da1f4b86143b98aa39_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3560
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\44e4cca7588b10da1f4b86143b98aa39_JaffaCakes118.dll,#1
  2⤵
  PID:2460
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2460 -s 684
    3⤵
    - Program crash
    PID:764

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 2460 -ip 2460
1⤵
PID:2972

memory/2460-0-0x0000000002030000-0x0000000002136000-memory.dmp

Filesize
1.0MB

Download
memory/2460-1-0x0000000002038000-0x0000000002039000-memory.dmp

Filesize
4KB

Download
memory/2460-2-0x0000000002030000-0x0000000002136000-memory.dmp

Filesize
1.0MB

Download