4b8a551f64a3deee2a69a3fb8c41b297e0516530b9fac6af94e233098de3e2fe

Analysis

max time kernel
125s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
27/06/2024, 10:15

Target

159f8436142d7386ddd71b8fc2d96d57_JaffaCakes118.dll
Size

44KB
MD5

159f8436142d7386ddd71b8fc2d96d57
SHA1

ec1e0128a5e503f8225fbb2ba50750d65497d25d
SHA256

4b8a551f64a3deee2a69a3fb8c41b297e0516530b9fac6af94e233098de3e2fe
SHA512

c018aa18364d80e759a005fa6a2c09a9948d5a9d1e81daff7963221040913e3f35cae8963ab8b972d8397a9813c15a5b051654be920b48c5d602eb7179f3e05a
SSDEEP

768:aSjMqQtQbQhlL2raQUS8BapoJwtCSN/5ukrpZwdsju+WfAmU8lGRofd9VEj55a05:tjMqaQbQL484CShMkrpZ63VBU8Qefcb5

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3056	1488	WerFault.exe	88

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2308 wrote to memory of 1488	2308	rundll32.exe	88
PID 2308 wrote to memory of 1488	2308	rundll32.exe	88
PID 2308 wrote to memory of 1488	2308	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\159f8436142d7386ddd71b8fc2d96d57_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2308
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\159f8436142d7386ddd71b8fc2d96d57_JaffaCakes118.dll,#1
  2⤵
  PID:1488
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1488 -s 628
    3⤵
    - Program crash
    PID:3056

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1488 -ip 1488
1⤵
PID:2616

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4460,i,15142778360084620907,1763097090506261076,262144 --variations-seed-version --mojo-platform-channel-handle=4372 /prefetch:8
1⤵
PID:3756

memory/1488-0-0x0000000000D30000-0x0000000000D41000-memory.dmp

Filesize
68KB

Download
memory/1488-1-0x0000000000D30000-0x0000000000D41000-memory.dmp

Filesize
68KB

Download