55c0bbab38561885199d93d49971725bbd3cab92ac761a3ece031cf20d46a7d8

Analysis

max time kernel
142s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
01/07/2024, 08:39

Target

1aa363b05f2de545920819b57926b259_JaffaCakes118.dll
Size

107KB
MD5

1aa363b05f2de545920819b57926b259
SHA1

deea0e98638d34a35c50c034a70a26cfb0a978cb
SHA256

55c0bbab38561885199d93d49971725bbd3cab92ac761a3ece031cf20d46a7d8
SHA512

e748de59a44cc46d0ff5f171737286b368c815e343c5bdddd760a0b23efbbc0ac6fa9218518f4eacad95e46c415f779cb674316e996590ecc071a10db796d20d
SSDEEP

3072:rQQ2IUtMlwBUOknmseqwH06YJtcrpLEslhO9l:rQQUtMlMUvmswwOos2

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2412	4464	WerFault.exe	91

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4616 wrote to memory of 4464	4616	rundll32.exe	91
PID 4616 wrote to memory of 4464	4616	rundll32.exe	91
PID 4616 wrote to memory of 4464	4616	rundll32.exe	91

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1aa363b05f2de545920819b57926b259_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4616
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1aa363b05f2de545920819b57926b259_JaffaCakes118.dll,#1
  2⤵
  PID:4464
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4464 -s 636
    3⤵
    - Program crash
    PID:2412

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4464 -ip 4464
1⤵
PID:2756

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4340 --field-trial-handle=2252,i,16022092570067181109,3235558581947505669,262144 --variations-seed-version /prefetch:8
1⤵
PID:540

memory/4464-0-0x0000000000A40000-0x0000000000A64000-memory.dmp

Filesize
144KB

Download
memory/4464-1-0x0000000000A40000-0x0000000000A64000-memory.dmp

Filesize
144KB

Download