2420a9073294526d800694b98118796763c3033c69cecfcea5f5b781d20bc9a7

Analysis

max time kernel
94s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
15-07-2024 05:46

Target

4878ef84f68026fc1a1be334f015abac_JaffaCakes118.dll
Size

77KB
MD5

4878ef84f68026fc1a1be334f015abac
SHA1

a3ab4d6b44279dc20f4eec9cc22426f57a4807cc
SHA256

2420a9073294526d800694b98118796763c3033c69cecfcea5f5b781d20bc9a7
SHA512

278b496b571753f492f8f94483366a73d9b7a8195a0f6ee3bb62067f6f305c7c5a35351443010f0613b175c0159614c7e9c089fc827cb65cacd3c9da4eeb67f2
SSDEEP

1536:Ql4Ol0PGc4R8Pv4Dw1yUpbQFnToIfxgY0r5ZmNiTJbD:Forc4RA8w1yUpbQtTBfxgY0r5ZmNiTJX

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4024	4796	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3912 wrote to memory of 4796	3912	rundll32.exe	83
PID 3912 wrote to memory of 4796	3912	rundll32.exe	83
PID 3912 wrote to memory of 4796	3912	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4878ef84f68026fc1a1be334f015abac_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3912
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4878ef84f68026fc1a1be334f015abac_JaffaCakes118.dll,#1
  2⤵
  PID:4796
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4796 -s 644
    3⤵
    - Program crash
    PID:4024

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k krnlsrvc
1⤵
PID:4864

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4796 -ip 4796
1⤵
PID:3528