c86f8b82aaf23520a516e73e79990bacde0377525058e14af6d1eef823a095a9

Analysis

max time kernel
142s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
12/05/2024, 00:05

Target

373ec50b6d6010d1291f5adb9ee7c08f_JaffaCakes118.dll
Size

134KB
MD5

373ec50b6d6010d1291f5adb9ee7c08f
SHA1

1faf61f28df82d1a7651e9d16c3e7278dd7fd2bc
SHA256

c86f8b82aaf23520a516e73e79990bacde0377525058e14af6d1eef823a095a9
SHA512

b334778739ec1ff4594933b519e602e98731f2bb3b4642041b12138d3ead0a2161dcaf4bcb0c2e6c2c8e016dbee4aee04996963e39e41f03b970dec90fa9eabc
SSDEEP

3072:itJqzI4aZE1ikVHdtC+XLOfgc0Mw5rZPE:hzEZE9W8VcHgrZs

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
628	2648	WerFault.exe	91

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 956 wrote to memory of 2648	956	rundll32.exe	91
PID 956 wrote to memory of 2648	956	rundll32.exe	91
PID 956 wrote to memory of 2648	956	rundll32.exe	91

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\373ec50b6d6010d1291f5adb9ee7c08f_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:956
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\373ec50b6d6010d1291f5adb9ee7c08f_JaffaCakes118.dll,#1
  2⤵
  PID:2648
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2648 -s 624
    3⤵
    - Program crash
    PID:628

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2648 -ip 2648
1⤵
PID:3656

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4064 --field-trial-handle=2356,i,13261194862334667799,7441241219475888176,262144 --variations-seed-version /prefetch:8
1⤵
PID:3316