1c84a5afb02cb075b1de9fd301c677704e972a2fc3a6fa3fcb2f8ee71f92d235

Analysis

max time kernel
141s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
24/06/2024, 17:54

Target

09f8558b05714db821621c87047ac396_JaffaCakes118.dll
Size

281KB
MD5

09f8558b05714db821621c87047ac396
SHA1

0ae6f1dfe3174f51edabca0ab18272a4da732a03
SHA256

1c84a5afb02cb075b1de9fd301c677704e972a2fc3a6fa3fcb2f8ee71f92d235
SHA512

ef82d6f931cbfd7ffa37efb24399c18acb5f4b41e77d9d97d8f5d6bfe7539e34ce52d03d86a37efb34d82a33a4c235690d90ae7034592e09b1d7a47340dbfe0f
SSDEEP

6144:WOsT5/b1q9HkRWk3XeSQ5SxrrzRlxQg3Pb4bV7olDnRly:yloERWknDkEXzXmgkbV7Yn

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1684	3016	WerFault.exe	94

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3016	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4484 wrote to memory of 3016	4484	rundll32.exe	94
PID 4484 wrote to memory of 3016	4484	rundll32.exe	94
PID 4484 wrote to memory of 3016	4484	rundll32.exe	94

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\09f8558b05714db821621c87047ac396_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4484
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\09f8558b05714db821621c87047ac396_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:3016
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3016 -s 652
    3⤵
    - Program crash
    PID:1684

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 3016 -ip 3016
1⤵
PID:4072

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4080 --field-trial-handle=2328,i,5873823382323802923,13134441441264702821,262144 --variations-seed-version /prefetch:8
1⤵
PID:3556

memory/3016-0-0x0000000010000000-0x00000000100EC000-memory.dmp

Filesize
944KB

Download
memory/3016-1-0x0000000002520000-0x0000000002522000-memory.dmp

Filesize
8KB

Download
memory/3016-2-0x0000000010000000-0x00000000100EC000-memory.dmp

Filesize
944KB

Download