4472ab9b3cde7d57fc5c400c5c69d889c563a4fa36522c3f7d89317c176cba34

Analysis

max time kernel
139s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
20/07/2024, 10:28

Target

601e58576d06ae8e7e30e3913cd3aa38_JaffaCakes118.dll
Size

106KB
MD5

601e58576d06ae8e7e30e3913cd3aa38
SHA1

23ee06716966856db37db035252d53ac97d4ceaf
SHA256

4472ab9b3cde7d57fc5c400c5c69d889c563a4fa36522c3f7d89317c176cba34
SHA512

0e5c5017e670aff5a5926b363d012bdfd6de3baae0646ed2a125a6c81f33854cc8c01090fb075aec991cc6f3983119470336236d677d02d8340201c7f3c4e653
SSDEEP

1536:KCYEOtQmrEkjK6TFtdveyoTc2lBfcw+iP+LqKLtUJppVnjwx:ROTE9WveyoThlxcw+g+5LtUJppVnjwx

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4972	2716	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4336 wrote to memory of 2716	4336	rundll32.exe	84
PID 4336 wrote to memory of 2716	4336	rundll32.exe	84
PID 4336 wrote to memory of 2716	4336	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\601e58576d06ae8e7e30e3913cd3aa38_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4336
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\601e58576d06ae8e7e30e3913cd3aa38_JaffaCakes118.dll,#1
  2⤵
  PID:2716
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2716 -s 660
    3⤵
    - Program crash
    PID:4972

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2716 -ip 2716
1⤵
PID:1664