f45f19141851c463a7cf571e81db6b0b9e312c8698e4ae9a7b1b6227e16ecf6d

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
23/07/2024, 05:54

Target

6662641b8dc4a056c8f264090c3fa3b5_JaffaCakes118.dll
Size

65KB
MD5

6662641b8dc4a056c8f264090c3fa3b5
SHA1

4a68196eef2abf28d7e10917d0624c710dadd999
SHA256

f45f19141851c463a7cf571e81db6b0b9e312c8698e4ae9a7b1b6227e16ecf6d
SHA512

1f4a137f75d2c5d5cb7cd0b0bc0cab833c3c9b5562fcda64665c4055b96da38136126b744cc77318f4289ffe01c20ff928a1cec01b062032cab18da93455e49e
SSDEEP

1536:kk6DNuEq7Nto7nA/3ufbadkk77y2XaHFi:Dr7Y0sbNka2Xali

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
408	5020	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2604 wrote to memory of 5020	2604	rundll32.exe	84
PID 2604 wrote to memory of 5020	2604	rundll32.exe	84
PID 2604 wrote to memory of 5020	2604	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6662641b8dc4a056c8f264090c3fa3b5_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2604
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6662641b8dc4a056c8f264090c3fa3b5_JaffaCakes118.dll,#1
  2⤵
  PID:5020
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5020 -s 556
    3⤵
    - Program crash
    PID:408

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 5020 -ip 5020
1⤵
PID:1212

memory/5020-0-0x0000000010000000-0x000000001003A000-memory.dmp

Filesize
232KB

Download