4cd610990cce8deb781521a4d734cf06504187e917e2a6411db59e148e4f3e22

Analysis

max time kernel
143s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
05/05/2024, 13:22

Target

17defbf2b269e16bebc0b415fb2eeede_JaffaCakes118.dll
Size

222KB
MD5

17defbf2b269e16bebc0b415fb2eeede
SHA1

f067e81fa7e3be60e33a05b66ca9fee451164ac5
SHA256

4cd610990cce8deb781521a4d734cf06504187e917e2a6411db59e148e4f3e22
SHA512

3c98207ab21f96cc2b36de63d1d1969efefad8ec456d476d5bdb89f40847f2eae20130e5db80937f3725bc5df9951d4aa90e958bb3e3d519621709fb3bb9fccf
SSDEEP

6144:M4R3XpqTBk33kglZ4KPbLKI33JXFpdZCiGAyf:M4puBk33kglZ4KPaI33JX3dZCPAE

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3768	4656	WerFault.exe	90

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4140 wrote to memory of 4656	4140	rundll32.exe	90
PID 4140 wrote to memory of 4656	4140	rundll32.exe	90
PID 4140 wrote to memory of 4656	4140	rundll32.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\17defbf2b269e16bebc0b415fb2eeede_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4140
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\17defbf2b269e16bebc0b415fb2eeede_JaffaCakes118.dll,#1
  2⤵
  PID:4656
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4656 -s 600
    3⤵
    - Program crash
    PID:3768

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4656 -ip 4656
1⤵
PID:5060

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3716 --field-trial-handle=2252,i,16504368816373493055,9578615028378602855,262144 --variations-seed-version /prefetch:8
1⤵
PID:1232