3fc147d27a08b55c0aa1d345be5fbab927438f798f76a555c6afe74732702673

Analysis

max time kernel
92s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
15-07-2024 11:00

Target

497d68a9e88a8e86ce87ccef554b2a00_JaffaCakes118.dll
Size

30KB
MD5

497d68a9e88a8e86ce87ccef554b2a00
SHA1

7ba968cc1d87d23593072415a76f559193b62a07
SHA256

3fc147d27a08b55c0aa1d345be5fbab927438f798f76a555c6afe74732702673
SHA512

1988ab7815312801f92c2b3a186269f6c40459a5ec03578ee3b5de8d758cdc003caf0e9552ada5ac5bb9ed47503ebb4cf2612003b1e7496f937390ad5fcb42a4
SSDEEP

768:QDFBxXRC9+B4VBfUvJgHPkWvWOJalay9h:QDnxU04VaUJaUM

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4708	2908	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3420 wrote to memory of 2908	3420	rundll32.exe	83
PID 3420 wrote to memory of 2908	3420	rundll32.exe	83
PID 3420 wrote to memory of 2908	3420	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\497d68a9e88a8e86ce87ccef554b2a00_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3420
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\497d68a9e88a8e86ce87ccef554b2a00_JaffaCakes118.dll,#1
  2⤵
  PID:2908
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2908 -s 560
    3⤵
    - Program crash
    PID:4708

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 2908 -ip 2908
1⤵
PID:1864

memory/2908-0-0x0000000010000000-0x0000000010018000-memory.dmp

Filesize
96KB

Download