cdceceec4bfcc6c135b556bc9efef8a07e5c9c85537562577b290275e4f32784

Analysis

max time kernel
142s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
20/06/2024, 03:51

Target

028faa87d542494a0ab47c26f950d27c_JaffaCakes118.dll
Size

40KB
MD5

028faa87d542494a0ab47c26f950d27c
SHA1

aa6232554bbe1027c0edf66839ba1fc0edf3d0b3
SHA256

cdceceec4bfcc6c135b556bc9efef8a07e5c9c85537562577b290275e4f32784
SHA512

07613b1bb8d02c07c59c175ae43bf39ada2fc50125ac656317109d4764130d1f8e008a95c69ed6737b9c6505ef494bf9edb6bc21cbd62066cbc8922746e6e22c
SSDEEP

768:5uDIo3eTTKWgVZPrv6fyyFmHXpGzbrn+55emgFI:Uko3en8v6fyyF8Kb+r+

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4428	5004	WerFault.exe	90

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 412 wrote to memory of 5004	412	rundll32.exe	90
PID 412 wrote to memory of 5004	412	rundll32.exe	90
PID 412 wrote to memory of 5004	412	rundll32.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\028faa87d542494a0ab47c26f950d27c_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:412
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\028faa87d542494a0ab47c26f950d27c_JaffaCakes118.dll,#1
  2⤵
  PID:5004
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5004 -s 548
    3⤵
    - Program crash
    PID:4428

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 5004 -ip 5004
1⤵
PID:4720

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4080 --field-trial-handle=2252,i,16504368816373493055,9578615028378602855,262144 --variations-seed-version /prefetch:8
1⤵
PID:2532