61b3c9381c53213ea00ea32c8cd1e156e270d98b564c4161710c125936adccd5

Analysis

max time kernel
139s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
19/07/2024, 15:49

Target

5c99898bf66c0433328dbf30d349b7e7_JaffaCakes118.dll
Size

72KB
MD5

5c99898bf66c0433328dbf30d349b7e7
SHA1

92248360f1f983bad1e526e6fef6d7a377cff926
SHA256

61b3c9381c53213ea00ea32c8cd1e156e270d98b564c4161710c125936adccd5
SHA512

5c0a0354446d97116a1c5d9aad8013715b35b8c0a485b94ef83b677202fbbb11dc95756d6526c10fad9b3170b8512d94c7adbc3ac76d247a2390a7344eddd53e
SSDEEP

1536:Sjjl3nwzSuOqBubw/WgT6zMKAOK2lCWcQajhRuv:C5UOq0ukgOK2l7aFQv

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4400	2724	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3412 wrote to memory of 2724	3412	rundll32.exe	84
PID 3412 wrote to memory of 2724	3412	rundll32.exe	84
PID 3412 wrote to memory of 2724	3412	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5c99898bf66c0433328dbf30d349b7e7_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3412
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5c99898bf66c0433328dbf30d349b7e7_JaffaCakes118.dll,#1
  2⤵
  PID:2724
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2724 -s 604
    3⤵
    - Program crash
    PID:4400

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 2724 -ip 2724
1⤵
PID:832