ee40c926c7ba0be2ea966ab84311194c1998f56e81c86e8e718409025629be9b

Analysis

max time kernel
139s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
19-07-2024 16:58

Target

5cd6b87952d0114bb2f736356f1284c4_JaffaCakes118.dll
Size

221KB
MD5

5cd6b87952d0114bb2f736356f1284c4
SHA1

fc2771fc34e82141ad15f0366725fd0d183e1bd3
SHA256

ee40c926c7ba0be2ea966ab84311194c1998f56e81c86e8e718409025629be9b
SHA512

b0b31dbe8c2826e06087435c26603c6ddabd54659715d42c3fc181d9dcb1d314ef07dd9a11aa35d432479f62c5181e8f6755fddc16229e07955c03c94f5ef311
SSDEEP

6144:A8JixMxALviUCNG80WNUWppM+PPNeRHpL:Auix9SEl8NeRHp

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
5076	1052	WerFault.exe	84
4360	1052	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4628 wrote to memory of 1052	4628	rundll32.exe	84
PID 4628 wrote to memory of 1052	4628	rundll32.exe	84
PID 4628 wrote to memory of 1052	4628	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5cd6b87952d0114bb2f736356f1284c4_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4628
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5cd6b87952d0114bb2f736356f1284c4_JaffaCakes118.dll,#1
  2⤵
  PID:1052
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1052 -s 560
    3⤵
    - Program crash
    PID:5076
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1052 -s 796
    3⤵
    - Program crash
    PID:4360

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 1052 -ip 1052
1⤵
PID:1836

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 1052 -ip 1052
1⤵
PID:4752