80cca5e32407e469db092d6e13da63567a38c00341997350e882cdd13936920d

Analysis

max time kernel
126s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
24-06-2024 22:05

Target

0adca909ad053b9435132c81a5cf3fb5_JaffaCakes118.dll
Size

3KB
MD5

0adca909ad053b9435132c81a5cf3fb5
SHA1

c365fbd99ea5e88b300e67df557263603e551b07
SHA256

80cca5e32407e469db092d6e13da63567a38c00341997350e882cdd13936920d
SHA512

999936b402507242d960b1ca3907923fa34a62283980277f1c238ec323e57d0ac41f9c96a4f97df410d0255489e24782de061fa7a8b2aab00de8ded8cf86502d

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5052	4424	WerFault.exe	89

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1624 wrote to memory of 4424	1624	rundll32.exe	89
PID 1624 wrote to memory of 4424	1624	rundll32.exe	89
PID 1624 wrote to memory of 4424	1624	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0adca909ad053b9435132c81a5cf3fb5_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1624
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0adca909ad053b9435132c81a5cf3fb5_JaffaCakes118.dll,#1
  2⤵
  PID:4424
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4424 -s 768
    3⤵
    - Program crash
    PID:5052

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3804,i,1809100026287847100,9768898026582633513,262144 --variations-seed-version --mojo-platform-channel-handle=3964 /prefetch:8
1⤵
PID:4092

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4424 -ip 4424
1⤵
PID:3844