c8ad61a8d8750e6bbda5b43733e9a0f70ca9df0d8d4df904f72706a4cf9ea154

Analysis

max time kernel
142s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
11-06-2024 12:40

Target

9e35ecdc339aef986de27c102a35ca0f_JaffaCakes118.dll
Size

205KB
MD5

9e35ecdc339aef986de27c102a35ca0f
SHA1

ab7af262fd791a84c07c972772cdf88dbf132874
SHA256

c8ad61a8d8750e6bbda5b43733e9a0f70ca9df0d8d4df904f72706a4cf9ea154
SHA512

1990f6ac68f94d0ae85419d4343fa2239e5753a99082eea0285194bfc3afa4f857da6fec62b65497c7ac1296253a3a8cd1824fc2b259e3625de5ce030aec3af6
SSDEEP

3072:5ZrNm0q1UmGTUVjsY9vsVfYLVthu1aYYp1V92R1n6/0IU1Dlw35p6B:5qV+KDCVfenh+Qfg2/0VW

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4592 212 WerFault.exe rundll32.exe

pid	pid_target	process	target process
4592	212	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4044 wrote to memory of 212	4044	rundll32.exe	rundll32.exe
PID 4044 wrote to memory of 212	4044	rundll32.exe	rundll32.exe
PID 4044 wrote to memory of 212	4044	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9e35ecdc339aef986de27c102a35ca0f_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4044

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9e35ecdc339aef986de27c102a35ca0f_JaffaCakes118.dll,#1
2⤵
PID:212

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 212 -s 684
3⤵
- Program crash
PID:4592

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 212 -ip 212
1⤵
PID:3248

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3804,i,1999448010053300448,1112699187621658374,262144 --variations-seed-version --mojo-platform-channel-handle=4004 /prefetch:8
1⤵
PID:4504