e5d80681b5d5df92c37cd592a1f93df721d1555da13814d4ec5281e5d29cf914

Analysis

max time kernel
139s
max time network
132s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
20/06/2024, 15:45

Target

076b25ce5dae146bc7306f48b6945f11_JaffaCakes118.dll
Size

45KB
MD5

076b25ce5dae146bc7306f48b6945f11
SHA1

bedaf67a5d40d6c02c1a8563bc33a27f85186722
SHA256

e5d80681b5d5df92c37cd592a1f93df721d1555da13814d4ec5281e5d29cf914
SHA512

11ca07d1cd4f3805d750b2e1c06e3d5bf962373c49ea4cdf6daf7d64ab8b5fc0e6abf28ce18d1ca552ef164c891828232aaa5a4ac26b324e13349a7ad4c3743f
SSDEEP

768:a2b9zhFSscyS/uhDg1akZUXVxfNa3AxQXo9fal:aw9jSszRMtmF9Dx4o8l

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1976	4032	WerFault.exe	92

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2840 wrote to memory of 4032	2840	rundll32.exe	92
PID 2840 wrote to memory of 4032	2840	rundll32.exe	92
PID 2840 wrote to memory of 4032	2840	rundll32.exe	92

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\076b25ce5dae146bc7306f48b6945f11_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2840
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\076b25ce5dae146bc7306f48b6945f11_JaffaCakes118.dll,#1
  2⤵
  PID:4032
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4032 -s 580
    3⤵
    - Program crash
    PID:1976

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4032 -ip 4032
1⤵
PID:4888

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=3860,i,5229431749694857451,16836185654682871752,262144 --variations-seed-version --mojo-platform-channel-handle=1304 /prefetch:8
1⤵
PID:1084

memory/4032-0-0x00000000005F0000-0x00000000005F1000-memory.dmp

Filesize
4KB

Download