eed9f54762b507ff8196af6a613cdfeae7673dafcd23252d4f82177bf980e85c

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
19-07-2024 01:09

Target

59da30f787728cdd2ea74e9f4b86c9e7_JaffaCakes118.dll
Size

56KB
MD5

59da30f787728cdd2ea74e9f4b86c9e7
SHA1

4dba94b870eb551107457cc057164938eadde33f
SHA256

eed9f54762b507ff8196af6a613cdfeae7673dafcd23252d4f82177bf980e85c
SHA512

f915f51a2435bbac48951a7fb03ecd908c8d806196a0198b4157872e6c0db5e82af9b93dcfba58ca3c001491e5e778d1cfee873380a5b4623ef6289487b184da
SSDEEP

1536:vSwlKC19SnIhSmSWDA42jsn2PfI/93CYNEkVfePM:nAMSKAIn24/9f2FM

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3836	4668	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5056 wrote to memory of 4668	5056	rundll32.exe	84
PID 5056 wrote to memory of 4668	5056	rundll32.exe	84
PID 5056 wrote to memory of 4668	5056	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\59da30f787728cdd2ea74e9f4b86c9e7_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5056
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\59da30f787728cdd2ea74e9f4b86c9e7_JaffaCakes118.dll,#1
  2⤵
  PID:4668
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4668 -s 564
    3⤵
    - Program crash
    PID:3836

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4668 -ip 4668
1⤵
PID:4248

memory/4668-0-0x0000000010000000-0x0000000010682000-memory.dmp

Filesize
6.5MB

Download