bfd845432437c5dc1880368b206de242ce9fcf3e693a693c92d5ce7bb6278bb6

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
16/07/2024, 04:24

Target

4cca0313c8d5589da522130626adfc04_JaffaCakes118.dll
Size

83KB
MD5

4cca0313c8d5589da522130626adfc04
SHA1

cfa64d484660054bf116de8ed5abda5b232921a0
SHA256

bfd845432437c5dc1880368b206de242ce9fcf3e693a693c92d5ce7bb6278bb6
SHA512

2d5fb639bcffe1a637f2b1e08b006f5285ddd5f0412c803527b69e4a6c1f1912f69f6ae43f4a175af0a33d05fcc1f76c89c1c0dce91395777106b5d1a8649b7f
SSDEEP

1536:qGPtceEzeW+xLWDYBQKUWqMvAsX1YAkPz2HEpGIsKk2Xpi7itlMGKnL:Z9EzvxY6ZWLAslYp0Ep7sKk2Xpi7itly

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3812	2268	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4264 wrote to memory of 2268	4264	rundll32.exe	83
PID 4264 wrote to memory of 2268	4264	rundll32.exe	83
PID 4264 wrote to memory of 2268	4264	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4cca0313c8d5589da522130626adfc04_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4264
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4cca0313c8d5589da522130626adfc04_JaffaCakes118.dll,#1
  2⤵
  PID:2268
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2268 -s 580
    3⤵
    - Program crash
    PID:3812

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2268 -ip 2268
1⤵
PID:784

memory/2268-0-0x0000000010000000-0x0000000010028000-memory.dmp

Filesize
160KB

Download