b1d246cc17cde0f5346a8cacf4660b4e948855397f7a1d8d82e2e96d2e66c539

Analysis

max time kernel
136s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
19/07/2024, 01:22

Target

59e34f2848c78250147899fe12b3a8b3_JaffaCakes118.dll
Size

25KB
MD5

59e34f2848c78250147899fe12b3a8b3
SHA1

743739e39c006f55932dee3edc58950e104cd5b0
SHA256

b1d246cc17cde0f5346a8cacf4660b4e948855397f7a1d8d82e2e96d2e66c539
SHA512

4302be0a83690943f6a6308e16651dce6f50a0ab9c9d8c8f3495ac01fbc81ed3b8c3462615d44d84355d3550b90865aa15f2c4f65db8f619d999cda27df63f64
SSDEEP

768:yk2Zuex9DEtQbO9811aMOFdOJKM+27siuVre:DeZOOaMOFdOz7si

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2360	4780	WerFault.exe	86

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2416 wrote to memory of 4780	2416	rundll32.exe	86
PID 2416 wrote to memory of 4780	2416	rundll32.exe	86
PID 2416 wrote to memory of 4780	2416	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\59e34f2848c78250147899fe12b3a8b3_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2416
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\59e34f2848c78250147899fe12b3a8b3_JaffaCakes118.dll,#1
  2⤵
  PID:4780
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4780 -s 560
    3⤵
    - Program crash
    PID:2360

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4780 -ip 4780
1⤵
PID:4740

memory/4780-0-0x0000000010000000-0x0000000010015000-memory.dmp

Filesize
84KB

Download