852271367ca50ba41d40470ca71bba5c9932381861a964acce0d3378257efdeb

Analysis

max time kernel
142s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
27/05/2024, 07:35

Target

785eccfcac902d9ab7d6bc1c117774af_JaffaCakes118.dll
Size

269KB
MD5

785eccfcac902d9ab7d6bc1c117774af
SHA1

ef7628112c0651b0a887cda5a42df91de3a16ce0
SHA256

852271367ca50ba41d40470ca71bba5c9932381861a964acce0d3378257efdeb
SHA512

2bb44b9fc8a5fdd4411f5646752b617a29a18d22bbd6aeaa5520a2b81cd3899fae9be3a4228a51c6163b6b27f68438145dd7b21341950ffbc8c87c8910713289
SSDEEP

6144:8prxxg76/T1VAwODO+ggme9O/CGv9ROtei5zOOA:Krxxg76/T14m2M94A

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3216	2368	WerFault.exe	90

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 652 wrote to memory of 2368	652	rundll32.exe	90
PID 652 wrote to memory of 2368	652	rundll32.exe	90
PID 652 wrote to memory of 2368	652	rundll32.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\785eccfcac902d9ab7d6bc1c117774af_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:652
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\785eccfcac902d9ab7d6bc1c117774af_JaffaCakes118.dll,#1
  2⤵
  PID:2368
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2368 -s 616
    3⤵
    - Program crash
    PID:3216

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2368 -ip 2368
1⤵
PID:4976

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3712 --field-trial-handle=2252,i,16504368816373493055,9578615028378602855,262144 --variations-seed-version /prefetch:8
1⤵
PID:4920