e0fef6e9e2fb9610a1e32780f24420d17e6f4f39de27557a319ef5df90a5bbe5

Analysis

max time kernel
139s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
21/07/2024, 21:03

Target

616312b3377f5f14bda96715c8faef49_JaffaCakes118.dll
Size

273KB
MD5

616312b3377f5f14bda96715c8faef49
SHA1

575da055f24f834c4e1ff6978914dcdcd7211748
SHA256

e0fef6e9e2fb9610a1e32780f24420d17e6f4f39de27557a319ef5df90a5bbe5
SHA512

56799b6df181a8653721c6a75d173b793813d884c6dc72c5c845e8d65a0f9d895e126bc8bd8df2492856b5bcd1f00e97b7d07eec04de7d3e1bdd2a67a193549e
SSDEEP

6144:sk813XD+nz/G3PiaAKd1HfxmF6ZvPynWmo7XSsZ5V:/kR3yAMGikSG

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3640	208	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4480 wrote to memory of 208	4480	rundll32.exe	84
PID 4480 wrote to memory of 208	4480	rundll32.exe	84
PID 4480 wrote to memory of 208	4480	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\616312b3377f5f14bda96715c8faef49_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4480
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\616312b3377f5f14bda96715c8faef49_JaffaCakes118.dll,#1
  2⤵
  PID:208
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 208 -s 544
    3⤵
    - Program crash
    PID:3640

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 208 -ip 208
1⤵
PID:3096

memory/208-0-0x0000000010000000-0x00000000100A6000-memory.dmp

Filesize
664KB

Download