431ba13e59959fcc644e8e0fcb5283bc95c0cd7057a582383c729ca0cff45e4d

Analysis

max time kernel
92s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
22/07/2024, 20:53

Target

64c4d3a71fecf3b558735c1e56d1a5ea_JaffaCakes118.dll
Size

48KB
MD5

64c4d3a71fecf3b558735c1e56d1a5ea
SHA1

4995c88592a45803ff0bd65b116cb578a793ce18
SHA256

431ba13e59959fcc644e8e0fcb5283bc95c0cd7057a582383c729ca0cff45e4d
SHA512

6421c9c9d91ba56b4cdfdee1c18355672ce2e65fd7ad88b84bd4ae1855f099154a86eafd3bbbbb514306e83a1e1682ef47d8cd175d0d8ce1bae3895be4ef7e21
SSDEEP

768:veggi4OgQd1wBKlMNVgyLXQeEI1qAZSE8D+e:veDi4OHaolMNVgyLjEUZ8D+

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4164	384	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4244 wrote to memory of 384	4244	rundll32.exe	84
PID 4244 wrote to memory of 384	4244	rundll32.exe	84
PID 4244 wrote to memory of 384	4244	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\64c4d3a71fecf3b558735c1e56d1a5ea_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4244
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\64c4d3a71fecf3b558735c1e56d1a5ea_JaffaCakes118.dll,#1
  2⤵
  PID:384
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 384 -s 612
    3⤵
    - Program crash
    PID:4164

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 384 -ip 384
1⤵
PID:896