70663e4beb4826523fc3e093f7d43b25d937b928cdfe52b680de8f7d2b98c5fe

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
22-07-2024 18:50

Target

645ec49b95f764235214b188d64ba452_JaffaCakes118.dll
Size

46KB
MD5

645ec49b95f764235214b188d64ba452
SHA1

89363254ce1f2f017ae02dad3d31ecc8972522c8
SHA256

70663e4beb4826523fc3e093f7d43b25d937b928cdfe52b680de8f7d2b98c5fe
SHA512

862d8b3a94c3712df8047eda20eedcb31f24f2aed9e1a61a4d215fc85a2df32e116284258cf61e2cb7a4e2fb2a6cf8192c90407a61a8699ba921acb9c9369344
SSDEEP

768:+hjs2Bb5A9FE2Q4Sy9a9QiA9wZ9gBdrduKku12QdWCyo9v8+:fCqM4lOGTj+toB8+

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4504	5060	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4240 wrote to memory of 5060	4240	rundll32.exe	84
PID 4240 wrote to memory of 5060	4240	rundll32.exe	84
PID 4240 wrote to memory of 5060	4240	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\645ec49b95f764235214b188d64ba452_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4240
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\645ec49b95f764235214b188d64ba452_JaffaCakes118.dll,#1
  2⤵
  PID:5060
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5060 -s 540
    3⤵
    - Program crash
    PID:4504

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 5060 -ip 5060
1⤵
PID:4896

memory/5060-0-0x00000000009D0000-0x00000000009D1000-memory.dmp

Filesize
4KB

Download