d5281d543ae427f7b2960b2f99e4a2c2ece25186fe9c0da8bc0119c0148ee75f

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
20/07/2024, 22:14

Target

602f1201269dce02a2dcf3164dfef7c9_JaffaCakes118.dll
Size

44KB
MD5

602f1201269dce02a2dcf3164dfef7c9
SHA1

f31de5f62991ac71caa4f9ee9339e016c679376c
SHA256

d5281d543ae427f7b2960b2f99e4a2c2ece25186fe9c0da8bc0119c0148ee75f
SHA512

a1db0a127f8bd5d03513eba2cf8c1eab35038347e72f19461f0a20cc94cdad7f5e2787e6e9d7f8dc4bf1369415b217a0ca16b0d3d397ad2aab8fc324959229f7
SSDEEP

384:ngUgzMT17YMsoUKrP9Uv3723DMsrV31JySnmgZyulgN995BH:iwT17YP49Uv3kD9Dxm8ypr

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3128	440	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4884 wrote to memory of 440	4884	rundll32.exe	84
PID 4884 wrote to memory of 440	4884	rundll32.exe	84
PID 4884 wrote to memory of 440	4884	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\602f1201269dce02a2dcf3164dfef7c9_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4884
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\602f1201269dce02a2dcf3164dfef7c9_JaffaCakes118.dll,#1
  2⤵
  PID:440
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 440 -s 544
    3⤵
    - Program crash
    PID:3128

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 440 -ip 440
1⤵
PID:3976