a1ef9e2909109a9dd0c326cc65ea85b945e857ff566c5427022d7f0e03900227

Analysis

max time kernel
93s
max time network
100s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
15/07/2024, 14:23

Target

4a0d5b6d7fba008f00d1e0e2879e1820_JaffaCakes118.dll
Size

64KB
MD5

4a0d5b6d7fba008f00d1e0e2879e1820
SHA1

401f479efe37aa78526358ba614809530046f286
SHA256

a1ef9e2909109a9dd0c326cc65ea85b945e857ff566c5427022d7f0e03900227
SHA512

aa89a055308f3f8413b9672605f64fce51fef6e7d74d293cc1634c8606fdf7ba22750e7ab876003cf136513711b676f50df8f330bcedfff6fc721b071c710f8c
SSDEEP

1536:1MwJkeMny2kDO86nyztP5Q7LVr6eEqPcXv8MH867H+bOwi1TlFpN:WwKjkJ8yztPWRvPc5cw+Qp

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2952	4820	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1288 wrote to memory of 4820	1288	rundll32.exe	83
PID 1288 wrote to memory of 4820	1288	rundll32.exe	83
PID 1288 wrote to memory of 4820	1288	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4a0d5b6d7fba008f00d1e0e2879e1820_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1288
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4a0d5b6d7fba008f00d1e0e2879e1820_JaffaCakes118.dll,#1
  2⤵
  PID:4820
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4820 -s 568
    3⤵
    - Program crash
    PID:2952

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4820 -ip 4820
1⤵
PID:1040