827ab7b6f1e2888ad9a1b9f9665bb099cd7a4a06dedc23c7e05c2d4b2e360103

Analysis

max time kernel
143s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
17-04-2024 04:44

Target

f50fa3b176ac4a269ca3b28ae24d09a2_JaffaCakes118.dll
Size

264KB
MD5

f50fa3b176ac4a269ca3b28ae24d09a2
SHA1

6d8c81bc7477910d104f155f670f14890d90dbf5
SHA256

827ab7b6f1e2888ad9a1b9f9665bb099cd7a4a06dedc23c7e05c2d4b2e360103
SHA512

e3949e490b12273c9413d5f977942d96e2b61bf98ad6af78d7edb03c63bc9f96e65f27ee3a4c021496e55bed873a9e31cf1e1f16c0797a000ac0c7cff76b7c19
SSDEEP

6144:Umfg2QbroZXmRUPK/wwzUyHwHlDi/2dTlpAa5oTHzPrQz5lusdLqwlSyVZMb:rfg24j/bzUyHwHgITlp55oTHzPravusO

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2028	1620	WerFault.exe	92

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 656 wrote to memory of 1620	656	rundll32.exe	92
PID 656 wrote to memory of 1620	656	rundll32.exe	92
PID 656 wrote to memory of 1620	656	rundll32.exe	92

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f50fa3b176ac4a269ca3b28ae24d09a2_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:656
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f50fa3b176ac4a269ca3b28ae24d09a2_JaffaCakes118.dll,#1
  2⤵
  PID:1620
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1620 -s 616
    3⤵
    - Program crash
    PID:2028

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1620 -ip 1620
1⤵
PID:3564

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3096 --field-trial-handle=2284,i,15722001240173834669,15048020084704567542,262144 --variations-seed-version /prefetch:8
1⤵
PID:4092

memory/1620-0-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/1620-1-0x0000000000AE0000-0x0000000000B1E000-memory.dmp

Filesize
248KB

Download
memory/1620-2-0x0000000000B40000-0x0000000000B41000-memory.dmp

Filesize
4KB

Download
memory/1620-3-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/1620-5-0x0000000000AE0000-0x0000000000B1E000-memory.dmp

Filesize
248KB

Download