0a9e81f1d8b0810e0f8733c180125b8720e29d926923dc6ff50799d578da4346

Analysis

max time kernel
136s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
19-07-2024 14:22

Target

5c4f7595b73608f2fe3bba06746ece08_JaffaCakes118.dll
Size

61KB
MD5

5c4f7595b73608f2fe3bba06746ece08
SHA1

be85cd0613418cae9a560942eccdf33086596309
SHA256

0a9e81f1d8b0810e0f8733c180125b8720e29d926923dc6ff50799d578da4346
SHA512

5f5536f8efa3059cbad492f009e1ec11e3dcfd04c4da9c2091e196bd3dac690e210b0a0bab4d2989b34acb0f8b726d737b52cf455099f1ed9a78f1ec6fbff3e5
SSDEEP

1536:ZpVa+oRDy8H8UupEHG2+Ld7d370jQgr4hf4H:ZpVaNRDy8HPupEHLCdpAUg8hf4H

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1908	4552	WerFault.exe	85

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1732 wrote to memory of 4552	1732	rundll32.exe	85
PID 1732 wrote to memory of 4552	1732	rundll32.exe	85
PID 1732 wrote to memory of 4552	1732	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5c4f7595b73608f2fe3bba06746ece08_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1732
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5c4f7595b73608f2fe3bba06746ece08_JaffaCakes118.dll,#1
  2⤵
  PID:4552
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4552 -s 580
    3⤵
    - Program crash
    PID:1908

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 4552 -ip 4552
1⤵
PID:2384

memory/4552-0-0x0000000010000000-0x000000001001E000-memory.dmp

Filesize
120KB

Download
memory/4552-1-0x00000000026E0000-0x000000000276C000-memory.dmp

Filesize
560KB

Download