a2d453fb710507f565d1b7ab531ed09193187ac806520fb694760328f43a59a5

Analysis

max time kernel
94s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
16/07/2024, 00:32

Target

4c12fa35f436a58c68ffcb1521d200f9_JaffaCakes118.dll
Size

25KB
MD5

4c12fa35f436a58c68ffcb1521d200f9
SHA1

6d1f880ded2930d658c21268c70d261911c01fd5
SHA256

a2d453fb710507f565d1b7ab531ed09193187ac806520fb694760328f43a59a5
SHA512

6425ec14da2773e8616bb4f63daf83001172b517c403ea99d865014bc0f7c184d1460b30e9e7a911ccdc09cf90ac76bcfd4d866704c9c093958793fcc3aeed5b
SSDEEP

384:TnEqUrWicZVaWNhs5qsj/DboOMqggno2keq9A0sI/FDIHPNWisbGWW9ji4GE2:TwDWNhs5q2/oOMDexIb+2

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4864	744	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1040 wrote to memory of 744	1040	rundll32.exe	83
PID 1040 wrote to memory of 744	1040	rundll32.exe	83
PID 1040 wrote to memory of 744	1040	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4c12fa35f436a58c68ffcb1521d200f9_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1040
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4c12fa35f436a58c68ffcb1521d200f9_JaffaCakes118.dll,#1
  2⤵
  PID:744
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 744 -s 600
    3⤵
    - Program crash
    PID:4864

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 744 -ip 744
1⤵
PID:2568