2d2e9c8c291c0316917f4608e73a78bd9fef3df01fd3cd2895c375c871732439

Analysis

max time kernel
95s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
15-07-2024 10:53

Target

4978154c70bcec83aa3ef549118f8670_JaffaCakes118.dll
Size

173KB
MD5

4978154c70bcec83aa3ef549118f8670
SHA1

1bf929da9edcd0609d29051deec3ed61587bc7e9
SHA256

2d2e9c8c291c0316917f4608e73a78bd9fef3df01fd3cd2895c375c871732439
SHA512

50fca0158ad364aa983047cd8980c7274b7a2a2d505d06baf36439d8125a7b12ca743cc9e50f703af664f2130118db13c28666aa2b5e6c4117f02ae008c502ef
SSDEEP

3072:XeZeKyJbvN/dSqA2xReFURUdXE3eXuOfO1LJW4LTkyagDic9/baswYzL/m18pf:XeZby9N1SoeGCdXErAO1RLLWswYz3p

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3732	212	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4580 wrote to memory of 212	4580	rundll32.exe	83
PID 4580 wrote to memory of 212	4580	rundll32.exe	83
PID 4580 wrote to memory of 212	4580	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4978154c70bcec83aa3ef549118f8670_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4580
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4978154c70bcec83aa3ef549118f8670_JaffaCakes118.dll,#1
  2⤵
  PID:212
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 212 -s 584
    3⤵
    - Program crash
    PID:3732

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 212 -ip 212
1⤵
PID:3016