bdc699c561f825b196cc910f71510c22569ddd7234f6f660cebf1dff364f594b

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
16/07/2024, 10:51

Target

4dfce420644baf195b73803e444a0561_JaffaCakes118.dll
Size

240KB
MD5

4dfce420644baf195b73803e444a0561
SHA1

0a390d066c1833136e01cf16a16c273a457db1ac
SHA256

bdc699c561f825b196cc910f71510c22569ddd7234f6f660cebf1dff364f594b
SHA512

5b129f18e7d0ddf2ccf043a5af1cfa21a9945f3e6c45f79381c9ccd042d6ed34603d50648dea156e2313222b31261e16b256f33d4633646d16765a5a4beddf30
SSDEEP

6144:opqbEM8EDmp7FnQh+Z95WlSk2j9nMIHd:0qbHnDmGY9MWDd

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4412	1016	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1780 wrote to memory of 1016	1780	rundll32.exe	83
PID 1780 wrote to memory of 1016	1780	rundll32.exe	83
PID 1780 wrote to memory of 1016	1780	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4dfce420644baf195b73803e444a0561_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1780
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4dfce420644baf195b73803e444a0561_JaffaCakes118.dll,#1
  2⤵
  PID:1016
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1016 -s 624
    3⤵
    - Program crash
    PID:4412

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 1016 -ip 1016
1⤵
PID:3652