b2b51a1c6f87428b0269f8615fb336fd97ed71fb8320328a042396b39bfc8430

Analysis

max time kernel
143s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 00:44

Target

692f06ceced57fbf22f6dd0a96fc37f8_JaffaCakes118.dll
Size

2.5MB
MD5

692f06ceced57fbf22f6dd0a96fc37f8
SHA1

74ee998d15fc5cc21b91f06402c6b05cacbd2185
SHA256

b2b51a1c6f87428b0269f8615fb336fd97ed71fb8320328a042396b39bfc8430
SHA512

5fd6a31a1e10594b421096cb6ae3dce5c9680b8292b1231c31ac85f2fe34fb48757701724d0a5c028f762e53d1fe1b14fee326787eaf488252d606cdc23fa020
SSDEEP

49152:6mrH52YGuaiucb2sdcdk3YZ/8/RRLMSaYzRFx1UvoOFMXYsejb:frHWuaiucb2sadHZ/8/PYYzRH1UvoOFP

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

576 228 WerFault.exe rundll32.exe

pid	pid_target	process	target process
576	228	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3968 wrote to memory of 228	3968	rundll32.exe	rundll32.exe
PID 3968 wrote to memory of 228	3968	rundll32.exe	rundll32.exe
PID 3968 wrote to memory of 228	3968	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\692f06ceced57fbf22f6dd0a96fc37f8_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3968

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\692f06ceced57fbf22f6dd0a96fc37f8_JaffaCakes118.dll,#1
2⤵
PID:228

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 228 -s 544
3⤵
- Program crash
PID:576

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 228 -ip 228
1⤵
PID:224

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1424 --field-trial-handle=1928,i,13242902252791919845,10377620236057253993,262144 --variations-seed-version /prefetch:8
1⤵
PID:4928

memory/228-0-0x00000000752D0000-0x00000000754A2000-memory.dmp

Filesize
1.8MB

Download