f3d226f19e8e084e2d3d781340a40fa2d367d2e2e67aed14a771653018fb8d9d

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
22/07/2024, 11:54

Target

63217ea85385c33660fe1d615b8a5e48_JaffaCakes118.dll
Size

306KB
MD5

63217ea85385c33660fe1d615b8a5e48
SHA1

a1b7fdb4e905395cfc22920bd5f3a33419cfbfa3
SHA256

f3d226f19e8e084e2d3d781340a40fa2d367d2e2e67aed14a771653018fb8d9d
SHA512

cb55d4e84ce56b3f7de9a81dc7634418ed0364455cacfcea8214b53610797d412a1a4a16971c99071aa3b075fc481765c7a6ef8a9fc18dbf6c71f519fc898ed2
SSDEEP

6144:M8vxM4dUpeUxfk8DqRvI2HdmD9TWWtWXPT0suN71GCTf1dZoeeDcwynf:MxViTykwsyG4dLYcwsf

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
5012	4544	WerFault.exe	84
2380	4544	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2420 wrote to memory of 4544	2420	rundll32.exe	84
PID 2420 wrote to memory of 4544	2420	rundll32.exe	84
PID 2420 wrote to memory of 4544	2420	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\63217ea85385c33660fe1d615b8a5e48_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2420
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\63217ea85385c33660fe1d615b8a5e48_JaffaCakes118.dll,#1
  2⤵
  PID:4544
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4544 -s 580
    3⤵
    - Program crash
    PID:5012
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4544 -s 556
    3⤵
    - Program crash
    PID:2380

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4544 -ip 4544
1⤵
PID:2624

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4544 -ip 4544
1⤵
PID:4532