6e0d49a889973ba876cd318494f12d883d51d4cb87c76d118db38a0e2fb8afdf

Analysis

max time kernel
136s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
19/07/2024, 06:17

Target

5ac845a4103e2daa2ed06b0b936eccd8_JaffaCakes118.dll
Size

313KB
MD5

5ac845a4103e2daa2ed06b0b936eccd8
SHA1

2e16ab5bd27e7e92a9eb436a502970fee8b01ab3
SHA256

6e0d49a889973ba876cd318494f12d883d51d4cb87c76d118db38a0e2fb8afdf
SHA512

3b83e1e0e24446d61560745469c5b5de3e8a490c341d8eb88be716710d13c8a48c84fd15edbfd3135cd9487f8d5c8c765a2b3a9cb66189da6378d96f38164c8c
SSDEEP

6144:D/3Ewx7JmT+YVH2AiPWs9eOoyOhFiLWbld1KW7sWq7gJ:D/35YT+Px+sLQMLW5d8WAZgJ

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1908	1348	WerFault.exe	87

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1800 wrote to memory of 1348	1800	rundll32.exe	87
PID 1800 wrote to memory of 1348	1800	rundll32.exe	87
PID 1800 wrote to memory of 1348	1800	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5ac845a4103e2daa2ed06b0b936eccd8_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1800
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5ac845a4103e2daa2ed06b0b936eccd8_JaffaCakes118.dll,#1
  2⤵
  PID:1348
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1348 -s 580
    3⤵
    - Program crash
    PID:1908

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1348 -ip 1348
1⤵
PID:2084

memory/1348-0-0x0000000010000000-0x000000001009D000-memory.dmp

Filesize
628KB

Download
memory/1348-1-0x0000000010000000-0x000000001009D000-memory.dmp

Filesize
628KB

Download