307e7edb339b9cb422a0fc90b3519f75f65daa3580c02be0e37d4e3903328886

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
16-07-2024 00:05

Target

4bfd3591c66b357713902403d4909390_JaffaCakes118.dll
Size

237KB
MD5

4bfd3591c66b357713902403d4909390
SHA1

3080c82abed6f20ccfc906eed352ac23f638b017
SHA256

307e7edb339b9cb422a0fc90b3519f75f65daa3580c02be0e37d4e3903328886
SHA512

dde6aff6e9434bc6eb40e2a072f10ee3bd4badc5afe2457326df0f1ef682f1a3ad0a81aee2dcd5eb7e06918c8a3e6327d542b92e503ada7fd091cdf65a5f556d
SSDEEP

3072:Tx7euwx79FBAd0zoCh2TjckJQU0hgRkaRSOoU0/KTqasu+PT7u/kiwwjK+eZf9eu:paVzaTF6HiIU0y2vPDiJKL8p2

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3052	528	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 892 wrote to memory of 528	892	rundll32.exe	83
PID 892 wrote to memory of 528	892	rundll32.exe	83
PID 892 wrote to memory of 528	892	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4bfd3591c66b357713902403d4909390_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:892
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4bfd3591c66b357713902403d4909390_JaffaCakes118.dll,#1
  2⤵
  PID:528
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 528 -s 580
    3⤵
    - Program crash
    PID:3052

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 528 -ip 528
1⤵
PID:4912