dc33e2254b0d72f0bf1cea059cb2f61d75dca3fecb31b92b08d8bb0901a76390

Analysis

max time kernel
94s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
14/07/2024, 14:56

Target

46507749e8844c96b54148f8aeaa5643_JaffaCakes118.dll
Size

212KB
MD5

46507749e8844c96b54148f8aeaa5643
SHA1

71429e10a487267f21a25eab2b3fd2ff89a14b44
SHA256

dc33e2254b0d72f0bf1cea059cb2f61d75dca3fecb31b92b08d8bb0901a76390
SHA512

eb415f14e33dd28a4e834a86061fe23e7788c1bcd14d6451a90e8dd1d89eb7dcc01527ecdcc02c6f396881c7b5839100131ab54b37f14ea65d469fba622be4cd
SSDEEP

6144:TRrESqG/GrGVBMInXZA8P29CimXV9gCIL7L:VrEwqGV5fWVml9g1

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2936	3124	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1924 wrote to memory of 3124	1924	rundll32.exe	83
PID 1924 wrote to memory of 3124	1924	rundll32.exe	83
PID 1924 wrote to memory of 3124	1924	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\46507749e8844c96b54148f8aeaa5643_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1924
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\46507749e8844c96b54148f8aeaa5643_JaffaCakes118.dll,#1
  2⤵
  PID:3124
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3124 -s 544
    3⤵
    - Program crash
    PID:2936

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3124 -ip 3124
1⤵
PID:2560

memory/3124-0-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download