dd845191bbe284247dcde2bf4bcdd7de894c2b79090bdf8172fc780606fbe68a

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
20-07-2024 00:50

Target

5e6488cb856a51c95f4be08666008e81_JaffaCakes118.dll
Size

120KB
MD5

5e6488cb856a51c95f4be08666008e81
SHA1

63e5e8c76206c195ef773cbf0c336b80d09fc4d4
SHA256

dd845191bbe284247dcde2bf4bcdd7de894c2b79090bdf8172fc780606fbe68a
SHA512

b4a3baf9fa0cab0cc844dc30159797fb4ad1a01c57efe0ef61096e0774c6eeb43dca59a1402834f60181ea7a4927582734c8d6dd2aa828712c7467afcc1efe9b
SSDEEP

3072:vzKmDDD95qf7Ot8Tb4igc/woSIiBOwAF2ix:WmDhE6tiPX/woSIWix

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
408	3508	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1972 wrote to memory of 3508	1972	rundll32.exe	84
PID 1972 wrote to memory of 3508	1972	rundll32.exe	84
PID 1972 wrote to memory of 3508	1972	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5e6488cb856a51c95f4be08666008e81_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1972
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5e6488cb856a51c95f4be08666008e81_JaffaCakes118.dll,#1
  2⤵
  PID:3508
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3508 -s 560
    3⤵
    - Program crash
    PID:408

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3508 -ip 3508
1⤵
PID:1396

memory/3508-0-0x0000000010000000-0x0000000010020000-memory.dmp

Filesize
128KB

Download