d9b8def6fb569cd1472e86b99d1ef09f608ce492756037e4e3592f432ebeccfc

Analysis

max time kernel
142s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
24-05-2024 01:45

Target

6cf73f9d9fe323cf9ee98f20055fc321_JaffaCakes118.dll
Size

8.0MB
MD5

6cf73f9d9fe323cf9ee98f20055fc321
SHA1

9c96f4b2e391cdd5339a116478a0a3c55481e96d
SHA256

d9b8def6fb569cd1472e86b99d1ef09f608ce492756037e4e3592f432ebeccfc
SHA512

4bca06a65a46058117944d908f45fbe2a37f5e28833b15807662cddf19333ec8158234814c89ffa96f2fe53b92b47292a2b70cfa854a8c013af02b5ec74af59a
SSDEEP

196608:IygCYs2ZwXnBFB1OUt30AgS8ulDJNdFEvAwxJJHGU8SySc35:I6Ys263Bn1ptZ39NdFEIwrJdqSk5

Score

5^/10

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
228	rundll32.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3688	228	WerFault.exe	90
3260	228	WerFault.exe	90

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
228	rundll32.exe
228	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4868 wrote to memory of 228	4868	rundll32.exe	90
PID 4868 wrote to memory of 228	4868	rundll32.exe	90
PID 4868 wrote to memory of 228	4868	rundll32.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6cf73f9d9fe323cf9ee98f20055fc321_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4868
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6cf73f9d9fe323cf9ee98f20055fc321_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  PID:228
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 228 -s 636
    3⤵
    - Program crash
    PID:3688
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 228 -s 600
    3⤵
    - Program crash
    PID:3260

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 228 -ip 228
1⤵
PID:1096

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 228 -ip 228
1⤵
PID:2932

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3708 --field-trial-handle=1928,i,13242902252791919845,10377620236057253993,262144 --variations-seed-version /prefetch:8
1⤵
PID:4528

memory/228-0-0x0000000074750000-0x0000000074CA2000-memory.dmp

Filesize
5.3MB

Download
memory/228-1-0x0000000074670000-0x00000000754A2000-memory.dmp

Filesize
14.2MB

Download
memory/228-3-0x0000000002920000-0x0000000002921000-memory.dmp

Filesize
4KB

Download
memory/228-2-0x0000000002800000-0x0000000002801000-memory.dmp

Filesize
4KB

Download
memory/228-7-0x0000000074670000-0x00000000754A2000-memory.dmp

Filesize
14.2MB

Download