b64f1ec81b2c9943154cdad4a8f65d5188cbbc9f641715e7abfebfb64ec833db

Analysis

max time kernel
143s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
24/06/2024, 10:30

Target

07f9cfb3b7aa4d52e592eb6ac28a87a6_JaffaCakes118.dll
Size

39KB
MD5

07f9cfb3b7aa4d52e592eb6ac28a87a6
SHA1

871176fe02fd20893e4fe55ce2d360559d660fb0
SHA256

b64f1ec81b2c9943154cdad4a8f65d5188cbbc9f641715e7abfebfb64ec833db
SHA512

7cce3458522c9a30ee264b23c4b76a50ae4d6ff14f29d0f5e795e34186f0cc3c9057c239165a69a5bbfb3d3f6dee55dafc587dfde82734a98b542a13a7a37778
SSDEEP

768:488M1k98Aicj+Ecu0/GegrmVHuI6wWZk1/T66mrMP3EtMsMzo9bTP/:x1i8tkcdvgqMI6wWm1/TiwfEtbgohTP/

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
684	1620	WerFault.exe	93

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 656 wrote to memory of 1620	656	rundll32.exe	93
PID 656 wrote to memory of 1620	656	rundll32.exe	93
PID 656 wrote to memory of 1620	656	rundll32.exe	93

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\07f9cfb3b7aa4d52e592eb6ac28a87a6_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:656
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\07f9cfb3b7aa4d52e592eb6ac28a87a6_JaffaCakes118.dll,#1
  2⤵
  PID:1620
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1620 -s 568
    3⤵
    - Program crash
    PID:684

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1620 -ip 1620
1⤵
PID:1720

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3776 --field-trial-handle=2284,i,15722001240173834669,15048020084704567542,262144 --variations-seed-version /prefetch:8
1⤵
PID:1452