1ea888679f1f6caabac4f79b96e47259b12bfca47b7af64c565cc017a2c8e86b

Analysis

max time kernel
142s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
25/06/2024, 09:44

Target

0d98f8b6eb7a06f4a8919f934d176b21_JaffaCakes118.dll
Size

32KB
MD5

0d98f8b6eb7a06f4a8919f934d176b21
SHA1

af92d4c8c171ce1c0f2d376c21aa41a611f4fccb
SHA256

1ea888679f1f6caabac4f79b96e47259b12bfca47b7af64c565cc017a2c8e86b
SHA512

4f3aa6677db00b74393b8ae20fb345a8c7a2202b9a7f135334e3979cc362b3fb6c0eed9f9a7f249227a9dc5e741c45e1bd5b1d29519ef8b30172a7491ea2baef
SSDEEP

384:wt7F5/QuMZ23O5TBBLT0DuBmlZx3yKGAoIo9d+mx:wRFyVWYTBtgDn3KpIo9o

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3608	4048	WerFault.exe	91

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4832 wrote to memory of 4048	4832	rundll32.exe	91
PID 4832 wrote to memory of 4048	4832	rundll32.exe	91
PID 4832 wrote to memory of 4048	4832	rundll32.exe	91

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0d98f8b6eb7a06f4a8919f934d176b21_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4832
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0d98f8b6eb7a06f4a8919f934d176b21_JaffaCakes118.dll,#1
  2⤵
  PID:4048
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4048 -s 600
    3⤵
    - Program crash
    PID:3608

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4048 -ip 4048
1⤵
PID:3464

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3756 --field-trial-handle=2248,i,10247514684337323751,15511974759131734137,262144 --variations-seed-version /prefetch:8
1⤵
PID:4988