c40f5d59730133f97ca6be149834d054b4857b24d516921baece9e8447ec696f

Analysis

max time kernel
140s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
22/07/2024, 08:57

Target

6299069f61f81ac5b6a8774c1edae04a_JaffaCakes118.dll
Size

9KB
MD5

6299069f61f81ac5b6a8774c1edae04a
SHA1

5c9385db7bb87bd6839bb280e8d91a7bd670b56e
SHA256

c40f5d59730133f97ca6be149834d054b4857b24d516921baece9e8447ec696f
SHA512

7094a54be1c8990404cbdef9c38da917755a8c40c3da8326965ff99886fa33ade9d54f8400d40a4d974cc25bff43fc672f6a46f156b65fc67c864552744766cd
SSDEEP

96:q1V7dR7uwEU+hCT3GrxZ4MUtPNlz0MdG8EWvdM3IWwG34b:kuwEt8rsTUtPLzKNWSYWF4b

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4892	3928	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4332 wrote to memory of 3928	4332	rundll32.exe	84
PID 4332 wrote to memory of 3928	4332	rundll32.exe	84
PID 4332 wrote to memory of 3928	4332	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6299069f61f81ac5b6a8774c1edae04a_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4332
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6299069f61f81ac5b6a8774c1edae04a_JaffaCakes118.dll,#1
  2⤵
  PID:3928
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3928 -s 624
    3⤵
    - Program crash
    PID:4892

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 3928 -ip 3928
1⤵
PID:4368

memory/3928-0-0x0000000000790000-0x0000000000797000-memory.dmp

Filesize
28KB

Download