e15dd92035487b20ecf393eebc20cb50583df02890ecc200791fc94c4de77f38

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
14/07/2024, 18:13

Target

46f32618ec037eddc93c211c2667b80e_JaffaCakes118.dll
Size

131KB
MD5

46f32618ec037eddc93c211c2667b80e
SHA1

53708be6a6a2796e7f93e268435072338ca8698e
SHA256

e15dd92035487b20ecf393eebc20cb50583df02890ecc200791fc94c4de77f38
SHA512

4c27d261bee682be67913e521a9ffa2133cfa107e94e31150a499859d7ee7a35a3e3d2093216a6b1734228c577a332823adb4e0d4d54ee5f8a721bd1fe6d0c75
SSDEEP

3072:DZW828VY4GgNpx6CfwUiYZ8tmYtxJSov8t9/5W:U8pZGgNXpfwUlZ88YPvi/5W

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2200	2172	WerFault.exe	83

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2172	rundll32.exe
2172	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4880 wrote to memory of 2172	4880	rundll32.exe	83
PID 4880 wrote to memory of 2172	4880	rundll32.exe	83
PID 4880 wrote to memory of 2172	4880	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\46f32618ec037eddc93c211c2667b80e_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4880
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\46f32618ec037eddc93c211c2667b80e_JaffaCakes118.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2172
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2172 -s 576
    3⤵
    - Program crash
    PID:2200

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2172 -ip 2172
1⤵
PID:3084

memory/2172-0-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download