32f80f5790cf20bc149df9f4fc949c5a3e5f0b0f95545284f78b2388d1b60abb

Analysis

max time kernel
140s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
22-07-2024 09:50

Target

62bea2811c42b6e993c61e2df88fd133_JaffaCakes118.dll
Size

268KB
MD5

62bea2811c42b6e993c61e2df88fd133
SHA1

82ddfb1d82262e7636da32859509332cd559b555
SHA256

32f80f5790cf20bc149df9f4fc949c5a3e5f0b0f95545284f78b2388d1b60abb
SHA512

2b634cbf108503ed4888f3e10103cf0ccee9df29d4506c29d0798171f1bdf500009ad5244f29fea2a6a82f579bfb92df7326206ff4f21042e6c42152688285c7
SSDEEP

6144:RxOJ+b7LC8fKXAphSv2L4vHh1v0ffCjbQmUpC09pkaWNro:RG4DfXy1v4999W

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1664	3096	WerFault.exe	84
3720	3096	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5024 wrote to memory of 3096	5024	rundll32.exe	84
PID 5024 wrote to memory of 3096	5024	rundll32.exe	84
PID 5024 wrote to memory of 3096	5024	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\62bea2811c42b6e993c61e2df88fd133_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5024
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\62bea2811c42b6e993c61e2df88fd133_JaffaCakes118.dll,#1
  2⤵
  PID:3096
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3096 -s 552
    3⤵
    - Program crash
    PID:1664
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3096 -s 576
    3⤵
    - Program crash
    PID:3720

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 3096 -ip 3096
1⤵
PID:1208

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 3096 -ip 3096
1⤵
PID:1640