3eee35d9c9cd6a16c3db5df5a49d2af8a85f05e9a1987c61d311a4bccd5e342a

Analysis

max time kernel
141s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
04/06/2024, 18:30

Target

95dbd0eadf393bfc7dba9dbb846e1d20_JaffaCakes118.dll
Size

1.8MB
MD5

95dbd0eadf393bfc7dba9dbb846e1d20
SHA1

3c84e19b3630b5a3b89f2d25741eee89a9456290
SHA256

3eee35d9c9cd6a16c3db5df5a49d2af8a85f05e9a1987c61d311a4bccd5e342a
SHA512

523c018079c57bdea9e6df86b1a86a3e2ccd610bb88b05056e9483c776cc9424336cce269d6267715409ba1d9d094395b30e89a83809ff1fe2689e59ef8131a5
SSDEEP

49152:vbA+b22PVX0tz+GMMyXXas2HU3/zlrJecI8nND3:vbA+DVXUAXXcyLlrC8p3

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4524	4956	WerFault.exe	90

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	4956	rundll32.exe
Token: SeIncBasePriorityPrivilege	4956	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1184 wrote to memory of 4956	1184	rundll32.exe	90
PID 1184 wrote to memory of 4956	1184	rundll32.exe	90
PID 1184 wrote to memory of 4956	1184	rundll32.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\95dbd0eadf393bfc7dba9dbb846e1d20_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1184
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\95dbd0eadf393bfc7dba9dbb846e1d20_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4956
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4956 -s 760
    3⤵
    - Program crash
    PID:4524

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4956 -ip 4956
1⤵
PID:1560

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4048 --field-trial-handle=3060,i,1774866140584649235,8085848018931772189,262144 --variations-seed-version /prefetch:8
1⤵
PID:4892

memory/4956-0-0x0000000002790000-0x000000000301F000-memory.dmp

Filesize
8.6MB

Download
memory/4956-2-0x00000000009E0000-0x00000000009E3000-memory.dmp

Filesize
12KB

Download
memory/4956-1-0x0000000002790000-0x000000000301F000-memory.dmp

Filesize
8.6MB

Download
memory/4956-3-0x0000000002790000-0x000000000301F000-memory.dmp

Filesize
8.6MB

Download
memory/4956-6-0x00000000009E0000-0x00000000009E1000-memory.dmp

Filesize
4KB

Download
memory/4956-7-0x0000000002790000-0x000000000301F000-memory.dmp

Filesize
8.6MB

Download
memory/4956-8-0x0000000002790000-0x00000000028D1000-memory.dmp

Filesize
1.3MB

Download