43d382148d127e2c861555838e03ce57fbdd45b0f6ff9ee01fa76c9d4522d448

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
15/07/2024, 01:39

Target

47af37a0b1d5ee519b3993c9dde6e31a_JaffaCakes118.dll
Size

172KB
MD5

47af37a0b1d5ee519b3993c9dde6e31a
SHA1

be3a10eb0c43c8b8c29a5418dca1d421c838ed7d
SHA256

43d382148d127e2c861555838e03ce57fbdd45b0f6ff9ee01fa76c9d4522d448
SHA512

e21e05a4fda130394f71cf1d4f8c30b9d88771df4ff7cd5488806069f0a33cd32d9d9f7dd5f2a176e2fbc0e0c478d9ae1708765952df7c896c13be1c98c0b844
SSDEEP

3072:03Ne5Rah/8hNrXeVN4TCrVHAQEyj9hjzY4INqOFh+tROGs7:UA+hkhNrG4TCB+4hjzfsqOFyRh

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
964	3568	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3004 wrote to memory of 3568	3004	rundll32.exe	83
PID 3004 wrote to memory of 3568	3004	rundll32.exe	83
PID 3004 wrote to memory of 3568	3004	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\47af37a0b1d5ee519b3993c9dde6e31a_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3004
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\47af37a0b1d5ee519b3993c9dde6e31a_JaffaCakes118.dll,#1
  2⤵
  PID:3568
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3568 -s 560
    3⤵
    - Program crash
    PID:964

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3568 -ip 3568
1⤵
PID:1216

memory/3568-1-0x00000000011B0000-0x00000000011C0000-memory.dmp

Filesize
64KB

Download