1c4fd3dd0a2d9c3ccc9d024c81c12421870069fb5a03da6f0c37dac974394cdd

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
15/07/2024, 10:48

Target

49741fdf01e52f4c42c2549fd5ba54ce_JaffaCakes118.dll
Size

168KB
MD5

49741fdf01e52f4c42c2549fd5ba54ce
SHA1

551686242f723bb8560ad63bf74c1049ea0c6efc
SHA256

1c4fd3dd0a2d9c3ccc9d024c81c12421870069fb5a03da6f0c37dac974394cdd
SHA512

93fb08d5c7d3738e767a3f4afe214b828955bbaed51e6ef2a3efd99a533c6a89ff1607b4132a0ad1c634ceee61808084393a4a7fbe9a19985eadfe98e48f0f03
SSDEEP

3072:k1IM6ptoGzKtuNMSL1KyY6cDcw6IKPhjoXfhFYex1j2UuZiVeqUL4vlX5h3sqm:wITtzc8xt1PmXfrbl2dqUMvl5

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4812	4304	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3432 wrote to memory of 4304	3432	rundll32.exe	83
PID 3432 wrote to memory of 4304	3432	rundll32.exe	83
PID 3432 wrote to memory of 4304	3432	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\49741fdf01e52f4c42c2549fd5ba54ce_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3432
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\49741fdf01e52f4c42c2549fd5ba54ce_JaffaCakes118.dll,#1
  2⤵
  PID:4304
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4304 -s 580
    3⤵
    - Program crash
    PID:4812

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4304 -ip 4304
1⤵
PID:2124

memory/4304-1-0x0000000002CB0000-0x0000000002CC3000-memory.dmp

Filesize
76KB

Download