efc7e49de1cda1c942ff301ddcf7fcf08723d4afec31dee730fa7f45d570efee

Analysis

max time kernel
143s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
01/07/2024, 09:02

Target

1ab2a403e378c586ae47d4a1ac96fafb_JaffaCakes118.dll
Size

78KB
MD5

1ab2a403e378c586ae47d4a1ac96fafb
SHA1

1bdd95c32415b97ef29cadc1f3befecee1fb0e87
SHA256

efc7e49de1cda1c942ff301ddcf7fcf08723d4afec31dee730fa7f45d570efee
SHA512

92e38dcb53d3b1a4471d8c6124562f5fb925d059085210ed56e95796f4cbb19749791d2fdf1bd4cbf21dfd071ae241d83813a3655460a0562074027ad1a53622
SSDEEP

1536:lXuRrlGl+slHQLtXFNcASa8fO/TrnJ77jLsezjGdwfk0iH:8lotlHQDZ82/h7/s0GqM0I

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2856	3292	WerFault.exe	92

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5088 wrote to memory of 3292	5088	rundll32.exe	92
PID 5088 wrote to memory of 3292	5088	rundll32.exe	92
PID 5088 wrote to memory of 3292	5088	rundll32.exe	92

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1ab2a403e378c586ae47d4a1ac96fafb_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5088
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1ab2a403e378c586ae47d4a1ac96fafb_JaffaCakes118.dll,#1
  2⤵
  PID:3292
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3292 -s 608
    3⤵
    - Program crash
    PID:2856

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 3292 -ip 3292
1⤵
PID:2036

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1028 --field-trial-handle=2328,i,5873823382323802923,13134441441264702821,262144 --variations-seed-version /prefetch:8
1⤵
PID:1020

memory/3292-0-0x0000000010000000-0x0000000010027000-memory.dmp

Filesize
156KB

Download