d2278ab1e6f48c014f83f630375be1366cb7ef8511e6169265582b35fd5dba47

Analysis

max time kernel
125s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
25-06-2024 00:58

Target

0ba9a35bb2ada3b3462f18f14da249e4_JaffaCakes118.dll
Size

9KB
MD5

0ba9a35bb2ada3b3462f18f14da249e4
SHA1

48ad6c0242f740dfe9a439afaffb2e01ea97beba
SHA256

d2278ab1e6f48c014f83f630375be1366cb7ef8511e6169265582b35fd5dba47
SHA512

ba08e94e6e67a2f9dca7ac8420ac9d8207cd998a359951c9d38d0572847bb2d05972206d3a3c711f665197696e05f1da9509ecae98272d780a4a37077d8c2743
SSDEEP

96:q1V7dR7uwEU+hCT3GrxZ4MUtPNlz0MdG8EWvdM3IWwG34b3:kuwEt8rsTUtPLzKNWSYWF4b3

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2520	4708	WerFault.exe	88

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1416 wrote to memory of 4708	1416	rundll32.exe	88
PID 1416 wrote to memory of 4708	1416	rundll32.exe	88
PID 1416 wrote to memory of 4708	1416	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0ba9a35bb2ada3b3462f18f14da249e4_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1416
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0ba9a35bb2ada3b3462f18f14da249e4_JaffaCakes118.dll,#1
  2⤵
  PID:4708
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4708 -s 632
    3⤵
    - Program crash
    PID:2520

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4708 -ip 4708
1⤵
PID:1164

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4328,i,5047420736443372512,9747851268033796534,262144 --variations-seed-version --mojo-platform-channel-handle=4368 /prefetch:8
1⤵
PID:1596

memory/4708-0-0x0000000001430000-0x0000000001437000-memory.dmp

Filesize
28KB

Download
memory/4708-1-0x0000000001430000-0x0000000001437000-memory.dmp

Filesize
28KB

Download