47c20f9b6dc3229bf5ab6a2923aac30a1f6cb07efb144afd68baf10a307eb152

Analysis

max time kernel
139s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
22/07/2024, 09:01

Target

629cd001963c4ea9bec5e25074b3b28c_JaffaCakes118.dll
Size

5KB
MD5

629cd001963c4ea9bec5e25074b3b28c
SHA1

c290ad16828b6690007e5815d62316db3845ac70
SHA256

47c20f9b6dc3229bf5ab6a2923aac30a1f6cb07efb144afd68baf10a307eb152
SHA512

561c5d53b110fe7e614c3893e21fc1a4841e4f8c36769f896fddab3f40f3e64f8009b7274011e37349d3255a056e5b2438fdc92cbc6d3082d7ee4abb33acf19b
SSDEEP

96:5l8hHqR63yChYvOJ0fuYk9SSFKsvqBn9rXdwTpO8FIpY:7x2yChYvOJ0fuYO7KsvqlVdSE

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3576	2072	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3232 wrote to memory of 2072	3232	rundll32.exe	83
PID 3232 wrote to memory of 2072	3232	rundll32.exe	83
PID 3232 wrote to memory of 2072	3232	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\629cd001963c4ea9bec5e25074b3b28c_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3232
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\629cd001963c4ea9bec5e25074b3b28c_JaffaCakes118.dll,#1
  2⤵
  PID:2072
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2072 -s 544
    3⤵
    - Program crash
    PID:3576

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2072 -ip 2072
1⤵
PID:4240