e99f855503f9eb2cd900c1f88d0d38e9e7b155780390f8308d194d0c5172b2a3

Analysis

max time kernel
94s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
19-07-2024 03:41

Target

5a5454c33801985868e3a0e8f01d682b_JaffaCakes118.dll
Size

109KB
MD5

5a5454c33801985868e3a0e8f01d682b
SHA1

129c4627c6649d14e8556c5e64f89ad182459fd6
SHA256

e99f855503f9eb2cd900c1f88d0d38e9e7b155780390f8308d194d0c5172b2a3
SHA512

5f36088d45e62c853e281037ae7fe6f80e589b4813fd37b014ae9e82f3149942c818ed6fb192070132211e38ab5b32ecc24c641367816eecccda2bb9f300a4cc
SSDEEP

3072:AHOgI3g0ea1O8cbj7wgpsyyVG4slkLMiw+ZCAlFli:dw0e6jyyZeaSzuli

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3172	2124	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3996 wrote to memory of 2124	3996	rundll32.exe	84
PID 3996 wrote to memory of 2124	3996	rundll32.exe	84
PID 3996 wrote to memory of 2124	3996	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5a5454c33801985868e3a0e8f01d682b_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3996
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5a5454c33801985868e3a0e8f01d682b_JaffaCakes118.dll,#1
  2⤵
  PID:2124
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2124 -s 540
    3⤵
    - Program crash
    PID:3172

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 2124 -ip 2124
1⤵
PID:316

memory/2124-0-0x0000000010000000-0x000000001003B000-memory.dmp

Filesize
236KB

Download