3815f2f8149591f6014aa7d3503483e491d83eb381a543c25208b7cb9c3a2152

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
20/07/2024, 22:35

Target

603ff5c527679be101a32b3dd9c06cd3_JaffaCakes118.dll
Size

190KB
MD5

603ff5c527679be101a32b3dd9c06cd3
SHA1

6d4ee0ec9337dbf8d2ef00b88b3029727dde9e8f
SHA256

3815f2f8149591f6014aa7d3503483e491d83eb381a543c25208b7cb9c3a2152
SHA512

a96321bc3b7c478372b7cf074aad82c4d807b8397f1c7ea66c0ea420b7a5f4fbb98d0f4b76f9d61199f803e13691d292251dfe52b3b177c6eb7fd7a3d79eb1c3
SSDEEP

3072:nlOsgxdTMb1ZmoqV/X059nnFoMZymVxy8URFZtH4qiP8d98Wfat5bUod1lyjbLo7:nlOsgxl6ZmoYMnnFoOgRyqiPK9/C5b71

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4720	1016	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4804 wrote to memory of 1016	4804	rundll32.exe	84
PID 4804 wrote to memory of 1016	4804	rundll32.exe	84
PID 4804 wrote to memory of 1016	4804	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\603ff5c527679be101a32b3dd9c06cd3_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4804
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\603ff5c527679be101a32b3dd9c06cd3_JaffaCakes118.dll,#1
  2⤵
  PID:1016
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1016 -s 580
    3⤵
    - Program crash
    PID:4720

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 356 -p 1016 -ip 1016
1⤵
PID:4080