110676cb06f7b44a8ee3540f902f7f59263f2cb4fc2037990f4c89975fb8d755

Analysis

max time kernel
142s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
20/06/2024, 02:14

Target

01f7bb3bfcb5c32cdb63a6a34958b0a2_JaffaCakes118.dll
Size

11KB
MD5

01f7bb3bfcb5c32cdb63a6a34958b0a2
SHA1

c3858d06637a22243d6ad7f0a42d15496ef104b8
SHA256

110676cb06f7b44a8ee3540f902f7f59263f2cb4fc2037990f4c89975fb8d755
SHA512

beb4fb14761ccb704fd566a8a0f36b75878d86d9bec284ad332971b86c8547d1fafe5c7da55ed20d31e841f18cdd0cf123163db3ca0fe765863db696f3d78d38
SSDEEP

192:neB3a5eW3l0vdV+ZOfXSpYDMJUrjoaZvDqImcOKNZNJsfbVr7PbVg/zcU:CE52vDk7pYAyveImhKN6Vre1

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
444	4552	WerFault.exe	92

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4820 wrote to memory of 4552	4820	rundll32.exe	92
PID 4820 wrote to memory of 4552	4820	rundll32.exe	92
PID 4820 wrote to memory of 4552	4820	rundll32.exe	92

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\01f7bb3bfcb5c32cdb63a6a34958b0a2_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4820
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\01f7bb3bfcb5c32cdb63a6a34958b0a2_JaffaCakes118.dll,#1
  2⤵
  PID:4552
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4552 -s 584
    3⤵
    - Program crash
    PID:444

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 4552 -ip 4552
1⤵
PID:3552

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4080 --field-trial-handle=2328,i,5873823382323802923,13134441441264702821,262144 --variations-seed-version /prefetch:8
1⤵
PID:2172

memory/4552-0-0x0000000000510000-0x0000000000544000-memory.dmp

Filesize
208KB

Download
memory/4552-1-0x0000000000510000-0x0000000000544000-memory.dmp

Filesize
208KB

Download
memory/4552-2-0x00000000001F0000-0x00000000001F1000-memory.dmp

Filesize
4KB

Download