c7a2c9fc207de1da2b428f830e03adf23548e8479cd55eb3c5f9b16f1cff320d

Analysis

max time kernel
136s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
20/07/2024, 04:37

Target

5f0d221b219e2cb491bb46fca874e04c_JaffaCakes118.dll
Size

411KB
MD5

5f0d221b219e2cb491bb46fca874e04c
SHA1

2f294839b65afaeaa9848e4e53f6d719f20cf479
SHA256

c7a2c9fc207de1da2b428f830e03adf23548e8479cd55eb3c5f9b16f1cff320d
SHA512

862002a92c9f59f3cbb358e616dd463574056d789f97227d7c7612f67886ee81e3b156a83c0d611c61ebe044755548ed288702b61ab623b977e66322e533b713
SSDEEP

12288:97bLJMqHvbXGN40IKpzyrnp1z/Fgy5Ag:DMqHa+0Q1/Ojg

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1072	1240	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3116 wrote to memory of 1240	3116	rundll32.exe	84
PID 3116 wrote to memory of 1240	3116	rundll32.exe	84
PID 3116 wrote to memory of 1240	3116	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5f0d221b219e2cb491bb46fca874e04c_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3116
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5f0d221b219e2cb491bb46fca874e04c_JaffaCakes118.dll,#1
  2⤵
  PID:1240
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1240 -s 592
    3⤵
    - Program crash
    PID:1072

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 1240 -ip 1240
1⤵
PID:4476

memory/1240-0-0x00000000021A0000-0x00000000021E9000-memory.dmp

Filesize
292KB

Download