4cf293ef32e0be622f3e070538b44b1c189e3a1b4a3ee4c126b647b9c99577da

Analysis

max time kernel
95s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
14/07/2024, 07:39

Target

44e6e84841968d785684ac6d30227c38_JaffaCakes118.dll
Size

544KB
MD5

44e6e84841968d785684ac6d30227c38
SHA1

87c1c5e077a7ff60e5f84d93934d3dc7722276a2
SHA256

4cf293ef32e0be622f3e070538b44b1c189e3a1b4a3ee4c126b647b9c99577da
SHA512

aef48e179fb7d29969285063456c5ca7a98af56599cd7bd0bac7f84e6c9c42a1f18da0eb6a73eaae6a296a982f426734e443492ace6e657a79207e2ea4ae91f5
SSDEEP

12288:Ye9qBa6AjCEQGJpIxsOFsDc4zd36GxeBe:Ye0BAjCE/mxsOFsDnV6vA

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3032	1500	WerFault.exe	85

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4344 wrote to memory of 1500	4344	rundll32.exe	85
PID 4344 wrote to memory of 1500	4344	rundll32.exe	85
PID 4344 wrote to memory of 1500	4344	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\44e6e84841968d785684ac6d30227c38_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4344
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\44e6e84841968d785684ac6d30227c38_JaffaCakes118.dll,#1
  2⤵
  PID:1500
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1500 -s 584
    3⤵
    - Program crash
    PID:3032

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1500 -ip 1500
1⤵
PID:4960

memory/1500-0-0x0000000010000000-0x000000001008E000-memory.dmp

Filesize
568KB

Download