74fd242a40bd4c2354f700eb78357a56aae00cb9a48ce875ebff5faf2bdabbdc

Analysis

max time kernel
139s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
25/06/2024, 01:31

Target

0bce9be309b0af08d6b28d1b4f99e572_JaffaCakes118.dll
Size

169KB
MD5

0bce9be309b0af08d6b28d1b4f99e572
SHA1

6c5aee693103544bb2dbfce80cdb5ea2c3ea09c6
SHA256

74fd242a40bd4c2354f700eb78357a56aae00cb9a48ce875ebff5faf2bdabbdc
SHA512

7ccd0efc5b5e58193e2b89b0ecde20c8336393fada633d25c74f6dde6f5a87b6a81649a9db1ba0692f41eacb11fbd7b95e134d0eb0c0e7725635d8a0a5dfa6d1
SSDEEP

3072:vuhE6zRklwBGwRA72tVDtv7gPFB0rjmqyVDmJFd+cYqMTrLS7:vuh+wB+72tptvUv0rKqyJ5xG7

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4788	1680	WerFault.exe	91
1956	1680	WerFault.exe	91

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3708 wrote to memory of 1680	3708	rundll32.exe	91
PID 3708 wrote to memory of 1680	3708	rundll32.exe	91
PID 3708 wrote to memory of 1680	3708	rundll32.exe	91

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0bce9be309b0af08d6b28d1b4f99e572_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3708
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0bce9be309b0af08d6b28d1b4f99e572_JaffaCakes118.dll,#1
  2⤵
  PID:1680
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1680 -s 544
    3⤵
    - Program crash
    PID:4788
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1680 -s 820
    3⤵
    - Program crash
    PID:1956

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 196 -p 1680 -ip 1680
1⤵
PID:3384

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4080 --field-trial-handle=2744,i,16362475727591565961,3676688664819797550,262144 --variations-seed-version /prefetch:8
1⤵
PID:2100

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1680 -ip 1680
1⤵
PID:2936