9688e2c5ae8b5aced01decc616e77d8f93f7213c264367e40ad103444b5c28be

Analysis

max time kernel
115s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
17-06-2024 10:04

Target

b80aee2f00964da9f2f23da80048dae5_JaffaCakes118.dll
Size

2.8MB
MD5

b80aee2f00964da9f2f23da80048dae5
SHA1

b9f57f8f678396d296c244d13bf1216b08597b9c
SHA256

9688e2c5ae8b5aced01decc616e77d8f93f7213c264367e40ad103444b5c28be
SHA512

80ae090730c3224c97ae8e83bb51f376cf66c57f974b427c46fab42e7f6aab452bf247b0a6d214ae06b327dade888a37b22f5463812fc737f2571d4a62309dcd
SSDEEP

49152:hXGf6SmLCjTygftKaZdDOYZp6MHG9vLwfK2KZxklx5fKVpknBQZ:UiSmLC5ftK0p6MHG9zwS2KZxkl7Kvkq

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1820	3676	WerFault.exe	91

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2244 wrote to memory of 3676	2244	rundll32.exe	91
PID 2244 wrote to memory of 3676	2244	rundll32.exe	91
PID 2244 wrote to memory of 3676	2244	rundll32.exe	91

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b80aee2f00964da9f2f23da80048dae5_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2244
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b80aee2f00964da9f2f23da80048dae5_JaffaCakes118.dll,#1
  2⤵
  PID:3676
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3676 -s 632
    3⤵
    - Program crash
    PID:1820

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3676 -ip 3676
1⤵
PID:2316

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4124,i,6870419347051655189,5491911050420577193,262144 --variations-seed-version --mojo-platform-channel-handle=4420 /prefetch:8
1⤵
PID:3724