2f58a869711d2b28e6ecaac25cc2166daa46f7adfb719b7dd334e01c1474ca9b

Analysis

max time kernel
125s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
18/04/2024, 07:08

Target
f782fa626b0c53d9cca2fbb29a65f23f_JaffaCakes118.dll
Size 160KB
Sample240418-hypzmsec96
SHA256 2f58a869711d2b28e6ecaac25cc2166daa46f7adfb719b7dd334e01c1474ca9b
MD5 f782fa626b0c53d9cca2fbb29a65f23f
SHA1 9fabc6c255ea94262b6339e4b5949174afd30114
SHA512 2d023aa899d5025631534489c6a13de071113f36ae2ab32d53c833c749d262019f3c3bd7961f2da12753e389bab92f4bda429662dec77552a13c825258af9e18
SSDEEP 3072:SXZC1fhEIosP/HMP7kUj6IXE6i1xRqLCJVQPyR:uC1fWIpP/H67kU+I06i1DB
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3768	1684	WerFault.exe	89

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2772 wrote to memory of 1684	2772	rundll32.exe	89
PID 2772 wrote to memory of 1684	2772	rundll32.exe	89
PID 2772 wrote to memory of 1684	2772	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f782fa626b0c53d9cca2fbb29a65f23f_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2772
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f782fa626b0c53d9cca2fbb29a65f23f_JaffaCakes118.dll,#1
  2⤵
  PID:1684
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1684 -s 600
    3⤵
    - Program crash
    PID:3768

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4284,i,17229298512878960157,13441031190071685883,262144 --variations-seed-version --mojo-platform-channel-handle=4148 /prefetch:8
1⤵
PID:3984

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1684 -ip 1684
1⤵
PID:676