4c889f5fdffe7b6145b59232c1da5966bdeb57b6d21f38eebe12015903d456f6

Analysis

max time kernel
143s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
14-04-2024 21:06

Target

ef81a01e614a3a7c7a06171e8ec463b6_JaffaCakes118.dll
Size

135KB
MD5

ef81a01e614a3a7c7a06171e8ec463b6
SHA1

499cceeeb6485b34233b85fdbd5e26397423f0a7
SHA256

4c889f5fdffe7b6145b59232c1da5966bdeb57b6d21f38eebe12015903d456f6
SHA512

62f6dfe15b5b84ee773d0981de5a73734baeb8d7c6407959736387bed9e5655abfc62bc1febe67e6ea5176365ec0f8f8212cf177a4680c9236bf39cd546db9cd
SSDEEP

1536:fS0nQkNkx7AeJRhNUoCthFYJmw44uh9nVJUWlDYnyrCo5CqydiEz1t4PpZnM+zgV:zNelNEvKWZYKika1t4PpZ/bVn7Ch

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1612 1680 WerFault.exe rundll32.exe

pid	pid_target	process	target process
1612	1680	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 452 wrote to memory of 1680	452	rundll32.exe	rundll32.exe
PID 452 wrote to memory of 1680	452	rundll32.exe	rundll32.exe
PID 452 wrote to memory of 1680	452	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ef81a01e614a3a7c7a06171e8ec463b6_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:452
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ef81a01e614a3a7c7a06171e8ec463b6_JaffaCakes118.dll,#1
  2⤵
  PID:1680
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1680 -s 600
    3⤵
    - Program crash
    PID:1612

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 1680 -ip 1680
1⤵
PID:2348

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1408 --field-trial-handle=2744,i,16362475727591565961,3676688664819797550,262144 --variations-seed-version /prefetch:8
1⤵
PID:3104