7c890a1bdd75fae15501469a4ce86574b58b26feb232ad0e3968d5a23df73cb2

Analysis

max time kernel
95s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
15/07/2024, 05:37

Target

48715243647aa90f96aecd666ac0a63f_JaffaCakes118.dll
Size

242KB
MD5

48715243647aa90f96aecd666ac0a63f
SHA1

20856b44369f64cfb0e3030ae3937bb8c7b33d44
SHA256

7c890a1bdd75fae15501469a4ce86574b58b26feb232ad0e3968d5a23df73cb2
SHA512

5221ca483c7b40f3990813ed212f3099eb48c8233c3e6338230c3b5884a00576de07f983105118a45158a30ed0c8f19e3c204081309ae86c579759993c4f0faf
SSDEEP

6144:/ttgQtoUFhPLGCCuh71DTwcFh5JZpQXCl5lNtTM:nNLcq1DHh5VQXClXNtTM

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1004	2940	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4380 wrote to memory of 2940	4380	rundll32.exe	83
PID 4380 wrote to memory of 2940	4380	rundll32.exe	83
PID 4380 wrote to memory of 2940	4380	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\48715243647aa90f96aecd666ac0a63f_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4380
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\48715243647aa90f96aecd666ac0a63f_JaffaCakes118.dll,#1
  2⤵
  PID:2940
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2940 -s 580
    3⤵
    - Program crash
    PID:1004

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 2940 -ip 2940
1⤵
PID:4268