4e5684309d05ea827ae18ddea49dc05efea76605bbd365ffc3a1c7f015362ff3

Analysis

max time kernel
150s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
19-07-2024 05:17

Target

5a9bce48826a359f79875e092e13970f_JaffaCakes118.dll
Size

576KB
MD5

5a9bce48826a359f79875e092e13970f
SHA1

d355a82173c6a0df8a0716ce499182c1c3e4f33d
SHA256

4e5684309d05ea827ae18ddea49dc05efea76605bbd365ffc3a1c7f015362ff3
SHA512

4f0415d007091219bf10ea4b15fabd47b295ca309e4e500576d2f1030a78e27e691d081872203a9029239c527991cd0d96975b59b0ded9a0dc02462c0da904e3
SSDEEP

12288:L0pLJiXFUUgaUoZlf2Znmq78sKx5IHHgkeJPO1fP:wji1UdoZcZm5nyHgq

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3868	1196	WerFault.exe	86

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1600 wrote to memory of 1196	1600	rundll32.exe	86
PID 1600 wrote to memory of 1196	1600	rundll32.exe	86
PID 1600 wrote to memory of 1196	1600	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5a9bce48826a359f79875e092e13970f_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1600
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5a9bce48826a359f79875e092e13970f_JaffaCakes118.dll,#1
  2⤵
  PID:1196
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1196 -s 672
    3⤵
    - Program crash
    PID:3868

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1196 -ip 1196
1⤵
PID:3860

memory/1196-1-0x0000000001000000-0x0000000001082000-memory.dmp

Filesize
520KB

Download