e0efaa6d586b03f9e18353bc17a48924edc3757a3a387e76ae5c98322508b45d

Analysis

max time kernel
138s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
22/07/2024, 22:19

Target

65054a7f6e34fbdd3fc343b690057add_JaffaCakes118.dll
Size

14KB
MD5

65054a7f6e34fbdd3fc343b690057add
SHA1

57b1831bb0214b40b01f0b3543d2d619fcc3cccc
SHA256

e0efaa6d586b03f9e18353bc17a48924edc3757a3a387e76ae5c98322508b45d
SHA512

2310757e11542d8fc65a4051f8d505a2ee00fdaeb667621396069a1206fa214fe4369e7ac278adff0550fae020e386302a5f3b955fa4c6a83a8787c01c8fd57c
SSDEEP

24:e9GSOCWWXrodgaiVe8TKWlbjfjIKA5KW4tsJylNU0xsi:KOCJXrjaivN7IERL

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1180	2388	WerFault.exe	86

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5000 wrote to memory of 2388	5000	rundll32.exe	86
PID 5000 wrote to memory of 2388	5000	rundll32.exe	86
PID 5000 wrote to memory of 2388	5000	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\65054a7f6e34fbdd3fc343b690057add_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5000
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\65054a7f6e34fbdd3fc343b690057add_JaffaCakes118.dll,#1
  2⤵
  PID:2388
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2388 -s 560
    3⤵
    - Program crash
    PID:1180

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2388 -ip 2388
1⤵
PID:3316