5b5f1beecfa284f9d9062f3a66ae357ac49f3aeebed917775bf265771c886e1b

Analysis

max time kernel
142s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
04/04/2024, 19:03

Target

c0438156fb20ed808ea0cab040927d23_JaffaCakes118.dll
Size

241KB
MD5

c0438156fb20ed808ea0cab040927d23
SHA1

e3a0dfc09b6d277b92f9bab9d294922319db4a48
SHA256

5b5f1beecfa284f9d9062f3a66ae357ac49f3aeebed917775bf265771c886e1b
SHA512

ab052da0a9fba08e0f515d98877bfc1c471c0b63ba6ba13d34c27d80595369e0e122dad80b4131bf887e0efe35df0501e90eb59e906803beda439dc37dad6ffa
SSDEEP

1536:sC0eZ1t5HnwfdOFSw0BMwBfXO+gBrtwjVod5q/VyTt1xb1WWrDp0rtFLOt:s7z0wBftgBrCGaVyTt1xbTrSBFLOt

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1252	4128	WerFault.exe	93

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1820 wrote to memory of 4128	1820	rundll32.exe	93
PID 1820 wrote to memory of 4128	1820	rundll32.exe	93
PID 1820 wrote to memory of 4128	1820	rundll32.exe	93

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c0438156fb20ed808ea0cab040927d23_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1820
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c0438156fb20ed808ea0cab040927d23_JaffaCakes118.dll,#1
  2⤵
  PID:4128
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4128 -s 564
    3⤵
    - Program crash
    PID:1252

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4128 -ip 4128
1⤵
PID:4204

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4148 --field-trial-handle=2280,i,4114443225282860369,4764091921472631035,262144 --variations-seed-version /prefetch:8
1⤵
PID:4468