84a51972ab5bbca6705248f9d6518b76d8fc40611d14d70e26952aed01313402

Analysis

max time kernel
140s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
22-07-2024 16:33

Target

63ef759cde573abdb6d4d123a895ee73_JaffaCakes118.dll
Size

71KB
MD5

63ef759cde573abdb6d4d123a895ee73
SHA1

b3effad8f3fc99882b98d953a848d5c17f490209
SHA256

84a51972ab5bbca6705248f9d6518b76d8fc40611d14d70e26952aed01313402
SHA512

aacc1573c41f879bc7a734311e977454e21229cf825675d76504968c3a4169c685d8d481037153b668a5f553ca1155f12aaefaa5c6da6440c8bda5acbce2ce79
SSDEEP

1536:vSwlKC19SnIhSmCcOYZhnOsNStPvNvph2NdmKbE7jL:nAMCVYZhnONPV2NNbE7v

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2392	1096	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3700 wrote to memory of 1096	3700	rundll32.exe	84
PID 3700 wrote to memory of 1096	3700	rundll32.exe	84
PID 3700 wrote to memory of 1096	3700	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\63ef759cde573abdb6d4d123a895ee73_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3700
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\63ef759cde573abdb6d4d123a895ee73_JaffaCakes118.dll,#1
  2⤵
  PID:1096
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1096 -s 564
    3⤵
    - Program crash
    PID:2392

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 1096 -ip 1096
1⤵
PID:3560

memory/1096-0-0x0000000010000000-0x0000000010682000-memory.dmp

Filesize
6.5MB

Download