02dff3aeddda852fa6a97bba2fb193ec11f57f35a49bd8dfb0d8b1161a5e6e9b

Analysis

max time kernel
134s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
26/06/2024, 00:53

Target

102923578329ad08d9891fe2d2d8884d_JaffaCakes118.dll
Size

127KB
MD5

102923578329ad08d9891fe2d2d8884d
SHA1

b57118b172e6f5b4367a76bfc3a620b9822b679a
SHA256

02dff3aeddda852fa6a97bba2fb193ec11f57f35a49bd8dfb0d8b1161a5e6e9b
SHA512

220849b2be9b4bb4e726cd7ca57f22c701e3feb8c67831eb1eb3eb5f8039afd7b6dfb55515836f64263fd8cd3ba78639fd7a9184bf11adcfd92ed82a7bff87b8
SSDEEP

3072:0G7rzKJBMse6C0/kPPZ5hnfNO12dh43OL5PFn0wcccccccc:0Srs9C0/qPZ3A12dh430PFn0wccccccz

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1452	3408	WerFault.exe	90

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5076 wrote to memory of 3408	5076	rundll32.exe	90
PID 5076 wrote to memory of 3408	5076	rundll32.exe	90
PID 5076 wrote to memory of 3408	5076	rundll32.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\102923578329ad08d9891fe2d2d8884d_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5076
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\102923578329ad08d9891fe2d2d8884d_JaffaCakes118.dll,#1
  2⤵
  PID:3408
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3408 -s 540
    3⤵
    - Program crash
    PID:1452

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3408 -ip 3408
1⤵
PID:1688

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4088,i,12594301322143882025,16832588342008839449,262144 --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:8
1⤵
PID:4404