5e45ccd2b6bfeb5cbe8cd04c5805e6be583c660627d5d8fd6b878ffe623ef00e

Analysis

max time kernel
140s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
16/04/2024, 20:27

Target

f4431715cb8917d6299c3fd8e4ecc607_JaffaCakes118.dll
Size

152KB
MD5

f4431715cb8917d6299c3fd8e4ecc607
SHA1

93d2efbaa4855c1aef3c92930880a9708a6dcf6a
SHA256

5e45ccd2b6bfeb5cbe8cd04c5805e6be583c660627d5d8fd6b878ffe623ef00e
SHA512

bcb64eafee4c13b18ef341581caf8f3c2f9cd49858cc03392daca982d873d418c8bc89436b92d1076b71b86c5d3e21b9f4609b37cd2786cd387d38168deaf266
SSDEEP

3072:diZWvizd9gdc6NNs7E6rMmQIBdNp8hqHLU5bnLDNINaydsU:di9J9gdlQXWwqhqrAPKh

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4268	2236	WerFault.exe	92

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1576 wrote to memory of 2236	1576	rundll32.exe	92
PID 1576 wrote to memory of 2236	1576	rundll32.exe	92
PID 1576 wrote to memory of 2236	1576	rundll32.exe	92

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f4431715cb8917d6299c3fd8e4ecc607_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1576
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f4431715cb8917d6299c3fd8e4ecc607_JaffaCakes118.dll,#1
  2⤵
  PID:2236
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2236 -s 592
    3⤵
    - Program crash
    PID:4268

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 2236 -ip 2236
1⤵
PID:4160

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4068 --field-trial-handle=2236,i,5367110156796017614,12594004256180761011,262144 --variations-seed-version /prefetch:8
1⤵
PID:4328

memory/2236-0-0x0000000010000000-0x0000000010033000-memory.dmp

Filesize
204KB

Download
memory/2236-1-0x0000000000720000-0x0000000000742000-memory.dmp

Filesize
136KB

Download
memory/2236-2-0x0000000010000000-0x0000000010033000-memory.dmp

Filesize
204KB

Download
memory/2236-3-0x0000000000720000-0x0000000000742000-memory.dmp

Filesize
136KB

Download