87c27447c4975a05008addc045573aeb7068ffa42037db332d780dcf9b91d199

Analysis

max time kernel
140s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
19/04/2024, 14:13

Target

fa799ff90bb3b1f3d3f8c7333292db4b_JaffaCakes118.dll
Size

18KB
MD5

fa799ff90bb3b1f3d3f8c7333292db4b
SHA1

006d1f6d4d34193d4e75e8e5a615b3844b22f69a
SHA256

87c27447c4975a05008addc045573aeb7068ffa42037db332d780dcf9b91d199
SHA512

cbe5aff77642b709232b4e480bbb5409481fbc86b85e0484382658650e46e9e703439617afdc0edbef6c1a4ff75a54d854b89a9cb221f5e5ebf8cffd785f4d7f
SSDEEP

384:/VxhxrLEpP9o12/zVbKEKy62r6kht5eRc/5dFxLdWRPvh:txbwJ7hKs5+6t5eRc/5dLLa

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4764	1668	WerFault.exe	92

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1436 wrote to memory of 1668	1436	rundll32.exe	92
PID 1436 wrote to memory of 1668	1436	rundll32.exe	92
PID 1436 wrote to memory of 1668	1436	rundll32.exe	92

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fa799ff90bb3b1f3d3f8c7333292db4b_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1436
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\fa799ff90bb3b1f3d3f8c7333292db4b_JaffaCakes118.dll,#1
  2⤵
  PID:1668
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1668 -s 632
    3⤵
    - Program crash
    PID:4764

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 180 -p 1668 -ip 1668
1⤵
PID:3436

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3744 --field-trial-handle=3192,i,2785050981002401924,4037047756083432660,262144 --variations-seed-version /prefetch:8
1⤵
PID:1532