1d45b70491a090ffd3838cfa41d948c51523aaebf25dbeb0fa53d4f1ee260477

Analysis

max time kernel
95s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
14/07/2024, 13:13

Target

45f7c5d90469ea131e5039008ac24b5d_JaffaCakes118.dll
Size

28KB
MD5

45f7c5d90469ea131e5039008ac24b5d
SHA1

ac57026b8b1a02aceca1f688e906414f9df4d1b0
SHA256

1d45b70491a090ffd3838cfa41d948c51523aaebf25dbeb0fa53d4f1ee260477
SHA512

f9d3905febc06a8f7754c7a8e36daf0d887cacff635cdec74bd866fedf44c8c70c625a50e2bb1a611e7912506016bd7d85c2975a651f3f2d4388becf59452ff8
SSDEEP

192:4B8RyBc2Mg0gg0NtWHAXl237ohsfLIJEo18NvZVhwsJBovVPq4jqdWDIdWdXyCdu:IkqmGhsfLNl9hfB0NqdWEWdiP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4376	3132	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2824 wrote to memory of 3132	2824	rundll32.exe	83
PID 2824 wrote to memory of 3132	2824	rundll32.exe	83
PID 2824 wrote to memory of 3132	2824	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\45f7c5d90469ea131e5039008ac24b5d_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2824
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\45f7c5d90469ea131e5039008ac24b5d_JaffaCakes118.dll,#1
  2⤵
  PID:3132
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3132 -s 576
    3⤵
    - Program crash
    PID:4376

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3132 -ip 3132
1⤵
PID:3940