4b65269980baec91e1a5babc7b4cb0cb70aa595ffd07c8731bd0af83f0671225

Analysis

max time kernel
140s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
09-05-2024 18:03

Target

2b355c8cae7cc25ac7102ba38d126270_JaffaCakes118.dll
Size

8KB
MD5

2b355c8cae7cc25ac7102ba38d126270
SHA1

69eea1a76ee9a6b02f1f0300e989f5a01b840079
SHA256

4b65269980baec91e1a5babc7b4cb0cb70aa595ffd07c8731bd0af83f0671225
SHA512

54902ece423c7284eec730f58a7e70afa27f70de1742eec8830d2cde5ba15dfac739a0f4b19619172904f7c246859307c728090f0c538789edc33d20c6bbabfb
SSDEEP

192:jnzXVl+ysFm+2pZ566OZufB4oo98h9Yp+tnWFka:rzRsFm5pSrg5IKPYpqnWFka

Score

4^/10

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\msgsocm.log	rundll32.exe
File opened for modification	C:\Windows\msgsocm.log	rundll32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1980	3848	WerFault.exe	91

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4136 wrote to memory of 3848	4136	rundll32.exe	91
PID 4136 wrote to memory of 3848	4136	rundll32.exe	91
PID 4136 wrote to memory of 3848	4136	rundll32.exe	91

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2b355c8cae7cc25ac7102ba38d126270_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4136
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2b355c8cae7cc25ac7102ba38d126270_JaffaCakes118.dll,#1
  2⤵
  - Drops file in Windows directory
  PID:3848
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3848 -s 632
    3⤵
    - Program crash
    PID:1980

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3848 -ip 3848
1⤵
PID:3252

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3700 --field-trial-handle=2272,i,4858140932023865871,5726683989663339295,262144 --variations-seed-version /prefetch:8
1⤵
PID:4848

memory/3848-0-0x00000000608D0000-0x00000000608D9000-memory.dmp

Filesize
36KB

Download
memory/3848-2-0x00000000608D0000-0x00000000608D9000-memory.dmp

Filesize
36KB

Download