f12505e44022518e6da9db41f1f20b96ab6059284f5a7f79eb3358f40b896249

Analysis

max time kernel
131s
max time network
133s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
20-06-2024 18:35

Target

08b25dc9863532ce2cba51831117018a_JaffaCakes118.dll
Size

357KB
MD5

08b25dc9863532ce2cba51831117018a
SHA1

b5ba45744dd9737df7ab08183f0751cb5ac9409a
SHA256

f12505e44022518e6da9db41f1f20b96ab6059284f5a7f79eb3358f40b896249
SHA512

6813fc294114bc7a395e7df623a370c9e397ec4e4113ca48be774c11245fe9d1a81219df175c132af8d5d4c8611b9e26b25d4f3ccdbd76e897a527137fbd45bb
SSDEEP

6144:kJ9Mnxck/ipE3za46Q+Gjw/f6mpTaoFoa+SRWT35i3JyMiUoljTBd8A:vnykwE3WZbGjyloT3gEMiUoljTA

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3380	2248	WerFault.exe	89

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2652 wrote to memory of 2248	2652	rundll32.exe	89
PID 2652 wrote to memory of 2248	2652	rundll32.exe	89
PID 2652 wrote to memory of 2248	2652	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\08b25dc9863532ce2cba51831117018a_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2652
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\08b25dc9863532ce2cba51831117018a_JaffaCakes118.dll,#1
  2⤵
  PID:2248
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2248 -s 652
    3⤵
    - Program crash
    PID:3380

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2248 -ip 2248
1⤵
PID:1900

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4124,i,6166776566165096562,4582328833313060853,262144 --variations-seed-version --mojo-platform-channel-handle=4172 /prefetch:8
1⤵
PID:1644