ca0ce35ecbe61179ca3a8fcd01063b04353155fd0a50ebb41c69742c45fd5545

Analysis

max time kernel
125s
max time network
132s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
01/07/2024, 18:26

Target

1c0b7b156db947c949f18407de1d62b5_JaffaCakes118.dll
Size

83KB
MD5

1c0b7b156db947c949f18407de1d62b5
SHA1

c223e52e9e971f89e46115230e0070286c0b0022
SHA256

ca0ce35ecbe61179ca3a8fcd01063b04353155fd0a50ebb41c69742c45fd5545
SHA512

4c780e7accf30be1d9d5e05444b21c44e67a6a82d8c7910b4eed70e8dd73e5a6fa12b0d71e96b90e9c3b630a318d3db7222a01d2c6376c8844a80de775c4a19a
SSDEEP

768:/i6lJ/1CEQ8DOGnO/ZuDhBh2S8bdx2cxZWqOGRDoytiMHcCr1kT/E2S8:9bEuDOcO/ZEfkSYecxwq5oytaCxa/pS

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3400	3724	WerFault.exe	88

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2988 wrote to memory of 3724	2988	rundll32.exe	88
PID 2988 wrote to memory of 3724	2988	rundll32.exe	88
PID 2988 wrote to memory of 3724	2988	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1c0b7b156db947c949f18407de1d62b5_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2988
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1c0b7b156db947c949f18407de1d62b5_JaffaCakes118.dll,#1
  2⤵
  PID:3724
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3724 -s 544
    3⤵
    - Program crash
    PID:3400

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3724 -ip 3724
1⤵
PID:4380

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4180,i,9746875443948590908,1444894342962555245,262144 --variations-seed-version --mojo-platform-channel-handle=4332 /prefetch:8
1⤵
PID:2824

memory/3724-0-0x0000000010000000-0x0000000010027000-memory.dmp

Filesize
156KB

Download