c2e59faadf5da54dad7db99139d209838b84decf134d29edc073fbf8d0e38e60

Analysis

max time kernel
141s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
23/06/2024, 22:54

Target

0375ba9ea81440402eb093cd6a641981_JaffaCakes118.dll
Size

843KB
MD5

0375ba9ea81440402eb093cd6a641981
SHA1

2fa3265a4b9dda5361279c7f366b49b64e017d92
SHA256

c2e59faadf5da54dad7db99139d209838b84decf134d29edc073fbf8d0e38e60
SHA512

b05bc4a59d223f08f01848854492ac17ce5e718a6351cfd9bd603a38c4f96d6036278bf0d33b0bfd3f81eab42ee4e6c7e472dedc7f6c8087d404ce895a631af0
SSDEEP

24576:TEKkHyy0pLXqKK/byRPyWmQ4aeM9L1x+F3dm:Dhdiar9LK3Y

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2612	2024	WerFault.exe	91

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4188 wrote to memory of 2024	4188	rundll32.exe	91
PID 4188 wrote to memory of 2024	4188	rundll32.exe	91
PID 4188 wrote to memory of 2024	4188	rundll32.exe	91

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0375ba9ea81440402eb093cd6a641981_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4188
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0375ba9ea81440402eb093cd6a641981_JaffaCakes118.dll,#1
  2⤵
  PID:2024
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2024 -s 680
    3⤵
    - Program crash
    PID:2612

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2024 -ip 2024
1⤵
PID:2364

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3976 --field-trial-handle=2900,i,14549994492153927475,12895178890800740987,262144 --variations-seed-version /prefetch:8
1⤵
PID:2316

memory/2024-0-0x0000000001F70000-0x000000000204D000-memory.dmp

Filesize
884KB

Download
memory/2024-1-0x0000000001F70000-0x000000000204D000-memory.dmp

Filesize
884KB

Download