8177fde3398f2629cf39eda6ab047296a8521a375a3e310e3e0f333cc802edf6

Analysis

max time kernel
142s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
20/06/2024, 02:51

Target

022ff4c30846461ee6fa61720da35a11_JaffaCakes118.dll
Size

204KB
MD5

022ff4c30846461ee6fa61720da35a11
SHA1

cf56b9f00587a3b36af16e0f963603814048e999
SHA256

8177fde3398f2629cf39eda6ab047296a8521a375a3e310e3e0f333cc802edf6
SHA512

317f6af19d798f6e999b52c4e4cfe64835134971f9e3ac087ceae99f1fcdda7a641bc9907e503033321c8a7f27ff73f12152766f819f5468a4de2bd072c07a46
SSDEEP

3072:6eiMiBX7iWtXpdyDIYiD0cx3JXNbWqcZK3VYYHS/c2RhvmA0qHRcO5Vnk1XD6qml:Amm7x5MZAHT6JuA

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4588	5076	WerFault.exe	91

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2748 wrote to memory of 5076	2748	rundll32.exe	91
PID 2748 wrote to memory of 5076	2748	rundll32.exe	91
PID 2748 wrote to memory of 5076	2748	rundll32.exe	91

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\022ff4c30846461ee6fa61720da35a11_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2748
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\022ff4c30846461ee6fa61720da35a11_JaffaCakes118.dll,#1
  2⤵
  PID:5076
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5076 -s 592
    3⤵
    - Program crash
    PID:4588

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 5076 -ip 5076
1⤵
PID:2148

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4256 --field-trial-handle=2252,i,16022092570067181109,3235558581947505669,262144 --variations-seed-version /prefetch:8
1⤵
PID:2208