68897425418b02bafb963c1c18a3dfa15fa17e5b838df5f7d8e6751ee2f4665c

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
15/07/2024, 02:12

Target

47c8cb939aee9a5204fb8c0bb7f79fa9_JaffaCakes118.dll
Size

233KB
MD5

47c8cb939aee9a5204fb8c0bb7f79fa9
SHA1

bb7ee8cb7e50b42f94db4a7829d7ba0912091969
SHA256

68897425418b02bafb963c1c18a3dfa15fa17e5b838df5f7d8e6751ee2f4665c
SHA512

deb17e982dfd0d4813ee63792ac76ff936bea3445b8eb564a9f63192d64d18ae85bda3d2fe1834712359fb4373f8eaf315914c59f6061099f3c68b46e8c9dbb7
SSDEEP

6144:0t3D6K5UxIXWw6n0/QKzyIeWiLHYrfctLJJJkp4RsFNi0O:0FCxgWw9QKz/iLHYroTJkpQsFNi0

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1612	4872	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1252 wrote to memory of 4872	1252	rundll32.exe	83
PID 1252 wrote to memory of 4872	1252	rundll32.exe	83
PID 1252 wrote to memory of 4872	1252	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\47c8cb939aee9a5204fb8c0bb7f79fa9_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1252
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\47c8cb939aee9a5204fb8c0bb7f79fa9_JaffaCakes118.dll,#1
  2⤵
  PID:4872
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4872 -s 544
    3⤵
    - Program crash
    PID:1612

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4872 -ip 4872
1⤵
PID:3460

memory/4872-0-0x0000000002E20000-0x0000000002F34000-memory.dmp

Filesize
1.1MB

Download
memory/4872-1-0x0000000002E20000-0x0000000002F34000-memory.dmp

Filesize
1.1MB

Download