e8dc27c4d44b4ba09dc09ef8a284f36a5a41f6c4e49aa970316f7a6a14be3a2a

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
19-07-2024 07:03

Target

5ae9d9efb36913bf6487c6a3db91ccaf_JaffaCakes118.dll
Size

118KB
MD5

5ae9d9efb36913bf6487c6a3db91ccaf
SHA1

8ce0dc5bca9d6e376c16d2ff0f58e30f1b9abd73
SHA256

e8dc27c4d44b4ba09dc09ef8a284f36a5a41f6c4e49aa970316f7a6a14be3a2a
SHA512

c7fb7977c971a9899629bd7d446e82fe78d7e1581a6818b1bf242892ede6dbfc29b07e738618239b0081a89c05034ac3a910fc22de34ad10c3b7c4d4089a76ea
SSDEEP

3072:adngK7aidAEMG3hjHZdri+z6gBSOHZIJ5idPidfmiRDmdZ:ah77liNAviS5ZUsi

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1168	2996	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 928 wrote to memory of 2996	928	rundll32.exe	84
PID 928 wrote to memory of 2996	928	rundll32.exe	84
PID 928 wrote to memory of 2996	928	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5ae9d9efb36913bf6487c6a3db91ccaf_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:928
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5ae9d9efb36913bf6487c6a3db91ccaf_JaffaCakes118.dll,#1
  2⤵
  PID:2996
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2996 -s 572
    3⤵
    - Program crash
    PID:1168

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2996 -ip 2996
1⤵
PID:2504

memory/2996-0-0x0000000010000000-0x0000000010062000-memory.dmp

Filesize
392KB

Download