baaf485fc5fe438a01096af506bddc10cc634955e835301e6ed072c627cc4c16

Analysis

max time kernel
95s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
15-07-2024 18:14

Target

4ad6295ffe3ee21519ded532c452a9fc_JaffaCakes118.dll
Size

162KB
MD5

4ad6295ffe3ee21519ded532c452a9fc
SHA1

5393e5655f239badaf4b441028b4d4d20627e635
SHA256

baaf485fc5fe438a01096af506bddc10cc634955e835301e6ed072c627cc4c16
SHA512

9935bb38cc0c520630db55f124aa089384939804a6cb4e8a3b24094bd2a9e41797f40c87473297ba7396807b83250c898f2193c44fe704e31de7ad3eeb8fa7eb
SSDEEP

1536:CzYqX3yK1nVWC86c1ha32hHrHvpdmWfmdrOBjBx6KBQK46Llrn+bHm:CzY/ePDGhaEHyWfOSHxNsWKG

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
692	3260	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4860 wrote to memory of 3260	4860	rundll32.exe	83
PID 4860 wrote to memory of 3260	4860	rundll32.exe	83
PID 4860 wrote to memory of 3260	4860	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4ad6295ffe3ee21519ded532c452a9fc_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4860
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4ad6295ffe3ee21519ded532c452a9fc_JaffaCakes118.dll,#1
  2⤵
  PID:3260
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3260 -s 588
    3⤵
    - Program crash
    PID:692

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 3260 -ip 3260
1⤵
PID:976