55f97f4150b116f87a0dfbd994f2b765a726e3e74ff85b18f9355b09bef8fa55

Analysis

max time kernel
139s
max time network
113s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
23/07/2024, 08:43

Target

66e02f479a094cec1f18d79b05ebf6a2_JaffaCakes118.dll
Size

96KB
MD5

66e02f479a094cec1f18d79b05ebf6a2
SHA1

2165d1960f3238a15c344a5c698024454ecb68a2
SHA256

55f97f4150b116f87a0dfbd994f2b765a726e3e74ff85b18f9355b09bef8fa55
SHA512

d9ec7751e9d64e3981a43eb4945c1c726914637a7b39363896d5c108ae52056b6c9e4682d18ccf9f467e63352b7be779cad8acc5ba5fec9581de320c641554e5
SSDEEP

1536:nmEgDV9y5GXvkGwd5shTcgD/XLG99P5ju7/a9Z9+w:nmEgDzB8bdUcgz74PFuDa9ZYw

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4928	1268	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3364 wrote to memory of 1268	3364	rundll32.exe	84
PID 3364 wrote to memory of 1268	3364	rundll32.exe	84
PID 3364 wrote to memory of 1268	3364	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\66e02f479a094cec1f18d79b05ebf6a2_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3364
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\66e02f479a094cec1f18d79b05ebf6a2_JaffaCakes118.dll,#1
  2⤵
  PID:1268
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1268 -s 672
    3⤵
    - Program crash
    PID:4928

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1268 -ip 1268
1⤵
PID:1088