ac48eb57a4bd0ab280d6b5c8861fd598c3ebb6965f46c11fb5088add3a085dea

Analysis

max time kernel
140s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
19/07/2024, 15:04

Target

5c74d2628dc38bf0dbbfbcbd85a910fe_JaffaCakes118.dll
Size

109KB
MD5

5c74d2628dc38bf0dbbfbcbd85a910fe
SHA1

160d8001936c0e609a65cde766d8d1fc3ae587e9
SHA256

ac48eb57a4bd0ab280d6b5c8861fd598c3ebb6965f46c11fb5088add3a085dea
SHA512

43f595f3a84dac4f0e7643d82d28842f012cb92d9e2611d425736744458a6b2d48810f4dd34c02207a74e0758dca60105b54c47c4e977755e6a2f66a1253fa3c
SSDEEP

1536:WL/AicgTgIYKOocuI/zu1bDxme8g4uotPOhr/ntT+j7oYyaGf4Hfw:y/AS8jaqzu1bsRuoK+jNya1o

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3660	1848	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4980 wrote to memory of 1848	4980	rundll32.exe	84
PID 4980 wrote to memory of 1848	4980	rundll32.exe	84
PID 4980 wrote to memory of 1848	4980	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5c74d2628dc38bf0dbbfbcbd85a910fe_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4980
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5c74d2628dc38bf0dbbfbcbd85a910fe_JaffaCakes118.dll,#1
  2⤵
  PID:1848
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1848 -s 692
    3⤵
    - Program crash
    PID:3660

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 1848 -ip 1848
1⤵
PID:4412

memory/1848-0-0x0000000010000000-0x000000001001C000-memory.dmp

Filesize
112KB

Download
memory/1848-1-0x0000000010000000-0x000000001001C000-memory.dmp

Filesize
112KB

Download