3494a55e70d7a4013a5320dfdb5fe37d7244d88c0a9c200ec4acc6ce95e98ac6

Analysis

max time kernel
93s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
15/07/2024, 07:08

Target

48bda83757e78744ed817e0ddaa00e7f_JaffaCakes118.dll
Size

988KB
MD5

48bda83757e78744ed817e0ddaa00e7f
SHA1

5cdbea2124cdfc5490ab3134a4158f75b4690c85
SHA256

3494a55e70d7a4013a5320dfdb5fe37d7244d88c0a9c200ec4acc6ce95e98ac6
SHA512

177757096e58f73c3ccb823beece5f8329e0bcd7b3103873d977c788aceb584398ff37265ea0d8e21690c7ff6efe69483f86045ac5d4e3775ea27d7db36c4be6
SSDEEP

24576:ezZDIgtRrKynJaDW34IlLfA7chbcgeDe7l1q0pW1gf8B:edDx7L4IlUq2S/qLc6

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
636	1400	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1556 wrote to memory of 1400	1556	rundll32.exe	83
PID 1556 wrote to memory of 1400	1556	rundll32.exe	83
PID 1556 wrote to memory of 1400	1556	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\48bda83757e78744ed817e0ddaa00e7f_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1556
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\48bda83757e78744ed817e0ddaa00e7f_JaffaCakes118.dll,#1
  2⤵
  PID:1400
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1400 -s 600
    3⤵
    - Program crash
    PID:636

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 1400 -ip 1400
1⤵
PID:4588