b8813d15f9a843a555dd3fa1c83eb0965807946d61b5eae9b5b285f7d56c9ba8

Analysis

max time kernel
144s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
04/05/2024, 11:38

Target

1290200e40ae16a493b89ccf4173e81e_JaffaCakes118.dll
Size

11KB
MD5

1290200e40ae16a493b89ccf4173e81e
SHA1

bcbc4e9515a0add11aa8cc2554545436a2ee5884
SHA256

b8813d15f9a843a555dd3fa1c83eb0965807946d61b5eae9b5b285f7d56c9ba8
SHA512

a5b056379535285731cbe59b1fd749c0cfcadcacd2a8c8337795cc6cc313fc6dd0e8cf18dd9a2ed9ef39674f9a3349274c4734f67bde8ce2300dd6cc71955511
SSDEEP

192:5N2gQuUwXzioj4KALV2upWzVd7q1QDXEbBZ8KxHdGzyS/Vx:GJoiO8V2upW7vQjS/

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4884	3272	WerFault.exe	89

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1596 wrote to memory of 3272	1596	rundll32.exe	89
PID 1596 wrote to memory of 3272	1596	rundll32.exe	89
PID 1596 wrote to memory of 3272	1596	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1290200e40ae16a493b89ccf4173e81e_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1596
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1290200e40ae16a493b89ccf4173e81e_JaffaCakes118.dll,#1
  2⤵
  PID:3272
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3272 -s 612
    3⤵
    - Program crash
    PID:4884

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3272 -ip 3272
1⤵
PID:3764

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4140 --field-trial-handle=2692,i,8678872182442199182,12502579059484928042,262144 --variations-seed-version /prefetch:8
1⤵
PID:2456