6ade3de5683e919eccbad9004dbebdbac56e056e5c8ba34c047486b1cd221cde

Analysis

max time kernel
114s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
09/04/2024, 10:23

Target

e9c6a23ce032ab05c258d5bc7c3d0c09_JaffaCakes118.dll
Size

237KB
MD5

e9c6a23ce032ab05c258d5bc7c3d0c09
SHA1

6ab74fd863fc23018f55c922926e9f86cb4692c0
SHA256

6ade3de5683e919eccbad9004dbebdbac56e056e5c8ba34c047486b1cd221cde
SHA512

8b2bd14d48cd308856a7321c0ee06ec207dca1a6ab388b16a9a0340a8cadfe4749b5e4624f36f85b0afc5055da2d2f24133ca7ee84f47a515feff1e13b2e4b86
SSDEEP

6144:Amltx/EGUY+QYEnnaQeeaQeekQeesQee4jQeehQeee/sNVNzaYSMesy:AgDEGUYC0sNa/d

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4488	1056	WerFault.exe	91

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2572 wrote to memory of 1056	2572	rundll32.exe	91
PID 2572 wrote to memory of 1056	2572	rundll32.exe	91
PID 2572 wrote to memory of 1056	2572	rundll32.exe	91

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e9c6a23ce032ab05c258d5bc7c3d0c09_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2572
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\e9c6a23ce032ab05c258d5bc7c3d0c09_JaffaCakes118.dll,#1
  2⤵
  PID:1056
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1056 -s 676
    3⤵
    - Program crash
    PID:4488

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1056 -ip 1056
1⤵
PID:3520

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3748 --field-trial-handle=2240,i,16875000905773190493,11379096115878622792,262144 --variations-seed-version /prefetch:8
1⤵
PID:3020