005ee2fe851a1413b8cda6590a5371c7e5f6f9b0ee94c74717a4faa7d85f21d1

Analysis

max time kernel
148s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
21-07-2024 20:44

Target

61543eac6ad2f00a2b7f09e09cbe45e7_JaffaCakes118.dll
Size

72KB
MD5

61543eac6ad2f00a2b7f09e09cbe45e7
SHA1

d4ae3c944a7ee1d9ca0f7deda50dec4022436b77
SHA256

005ee2fe851a1413b8cda6590a5371c7e5f6f9b0ee94c74717a4faa7d85f21d1
SHA512

c7049e4f11a208693650ae52c13e41c611efba7f3be6b9e15fe7245534bfa06fd58a1d0bcdf55caffd33c4e9300f05ac09715dc94f9667088993dedebdf8f1aa
SSDEEP

1536:Sjjl3nwzSuOqBubw/WgT6zMKAOK2lCWcQajhRuP:C5UOq0ukgOK2l7aFQP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4116	3372	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3680 wrote to memory of 3372	3680	rundll32.exe	83
PID 3680 wrote to memory of 3372	3680	rundll32.exe	83
PID 3680 wrote to memory of 3372	3680	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\61543eac6ad2f00a2b7f09e09cbe45e7_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3680
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\61543eac6ad2f00a2b7f09e09cbe45e7_JaffaCakes118.dll,#1
  2⤵
  PID:3372
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3372 -s 604
    3⤵
    - Program crash
    PID:4116

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 3372 -ip 3372
1⤵
PID:1852