0ee2fc134f2b96d2500f54ff6d47da7871e9c1ab7e3f39c210b0142c6c1fc250

Analysis

max time kernel
137s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
20/07/2024, 00:04

Target

5e40a552279d1599bd078e5ffcd15017_JaffaCakes118.dll
Size

274KB
MD5

5e40a552279d1599bd078e5ffcd15017
SHA1

e8870a18b4d97a2250435b087a2a14d53938d1c2
SHA256

0ee2fc134f2b96d2500f54ff6d47da7871e9c1ab7e3f39c210b0142c6c1fc250
SHA512

e363682367ef6d86ed028efc885b2c9d5d75eee8d424fa8a3318d0eec14f11992e9d28ee578d335e723232ec583afa0e9ac880abbf148a480afd60aeb3d4e406
SSDEEP

6144:gPqXUfJY+djgdwfd6gF9s/buN0tOdQpu+e8LzVqzDs:gPPdjhfd6iKaGtOdQp1zQzY

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4276	4576	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3352 wrote to memory of 4576	3352	rundll32.exe	84
PID 3352 wrote to memory of 4576	3352	rundll32.exe	84
PID 3352 wrote to memory of 4576	3352	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5e40a552279d1599bd078e5ffcd15017_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3352
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5e40a552279d1599bd078e5ffcd15017_JaffaCakes118.dll,#1
  2⤵
  PID:4576
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4576 -s 548
    3⤵
    - Program crash
    PID:4276

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4576 -ip 4576
1⤵
PID:2288

memory/4576-0-0x0000000010000000-0x00000000100A6000-memory.dmp

Filesize
664KB

Download