9872bd8eae7859eb42fef38352c42a39629d8b7ca7f3fc4b9beb60ed54c66334

Analysis

max time kernel
143s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
14/07/2024, 18:17

Target

46f659f6113248632423c7ea3d76f793_JaffaCakes118.dll
Size

169KB
MD5

46f659f6113248632423c7ea3d76f793
SHA1

3132dcb9067e2a139686e44cf31f1482dcf524a6
SHA256

9872bd8eae7859eb42fef38352c42a39629d8b7ca7f3fc4b9beb60ed54c66334
SHA512

0c9f4ee53e5f5340c2e63ebbd06a36ad28a760ed0ec43a9f01c8ff373cacd5cecf732dc5f2919f2583ab8939de28ce1ac7be3228955ba1850671ac3355e4acb1
SSDEEP

3072:vuhE6zRkoGnKR8++IN25UvVJbSnDTT7Yvjb5y6UNfvyp+4zK5EEsx:vuhpGn8+u25EV1CT0KfvyAji

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4972	2160	WerFault.exe	83
3116	2160	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2704 wrote to memory of 2160	2704	rundll32.exe	83
PID 2704 wrote to memory of 2160	2704	rundll32.exe	83
PID 2704 wrote to memory of 2160	2704	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\46f659f6113248632423c7ea3d76f793_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2704
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\46f659f6113248632423c7ea3d76f793_JaffaCakes118.dll,#1
  2⤵
  PID:2160
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2160 -s 544
    3⤵
    - Program crash
    PID:4972
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2160 -s 804
    3⤵
    - Program crash
    PID:3116

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 2160 -ip 2160
1⤵
PID:3348

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 2160 -ip 2160
1⤵
PID:4840