b8c14c49a2287cdd138d1bd96e57ad8016e724fccce376647925383f24792cad

Analysis

max time kernel
139s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
21/07/2024, 22:38

Target

61b100e103776a08a995c9d2b4d24d19_JaffaCakes118.dll
Size

141KB
MD5

61b100e103776a08a995c9d2b4d24d19
SHA1

bcef6ddb6d8c59b4a824843c7949533628138896
SHA256

b8c14c49a2287cdd138d1bd96e57ad8016e724fccce376647925383f24792cad
SHA512

6a6f9bf6ef35f1ac1133e4b1b1ad7f6745b7781c6f5b5f92f4b18e9beb7975facfba36790da46f3b76ae2117b36db6078b000372033abdfcde01831378a1e152
SSDEEP

1536:pmPgbLJf3HDuDfG2D8A+n3UirQY3BWXwXZ9pRECj/rQTezvdlPI65IO/0+tuQ+8Y:2gbLFHg4QYRTvfQMFjT/0JQfSuE

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4612	3884	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4680 wrote to memory of 3884	4680	rundll32.exe	84
PID 4680 wrote to memory of 3884	4680	rundll32.exe	84
PID 4680 wrote to memory of 3884	4680	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\61b100e103776a08a995c9d2b4d24d19_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4680
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\61b100e103776a08a995c9d2b4d24d19_JaffaCakes118.dll,#1
  2⤵
  PID:3884
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3884 -s 728
    3⤵
    - Program crash
    PID:4612

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3884 -ip 3884
1⤵
PID:400

memory/3884-0-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3884-1-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download