5746381439329d62d8d10da783b54d7e5073d964edad91da13d47a7016b2d9bc

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
15-07-2024 10:35

Target

4969b055c2020c3ed0e98a389b332a3d_JaffaCakes118.dll
Size

72KB
MD5

4969b055c2020c3ed0e98a389b332a3d
SHA1

2bfa3902590f25952c2bcc7a790326f933f21cde
SHA256

5746381439329d62d8d10da783b54d7e5073d964edad91da13d47a7016b2d9bc
SHA512

35e1c1552b506279ec96d6e6740b0f4f358601886a69dde46e7e1f8ccf1f10bbabe7c7ff241800d86c8ed0ada95eb08faf35306b97079a69d5a1adab956316b1
SSDEEP

1536:Sjjl3nwzSuOqBubw/WgT6zMKAOK2lCWcQajhRuv:C5UOq0ukgOK2l7aFQv

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4256	3524	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2920 wrote to memory of 3524	2920	rundll32.exe	83
PID 2920 wrote to memory of 3524	2920	rundll32.exe	83
PID 2920 wrote to memory of 3524	2920	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4969b055c2020c3ed0e98a389b332a3d_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2920
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4969b055c2020c3ed0e98a389b332a3d_JaffaCakes118.dll,#1
  2⤵
  PID:3524
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3524 -s 600
    3⤵
    - Program crash
    PID:4256

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3524 -ip 3524
1⤵
PID:4528