c3f7565514256ccf20bb2c1b28435aaa477b08b467c3fe6a50d5d2373693dc36

Analysis

max time kernel
131s
max time network
133s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03/07/2024, 19:01

Target

236c2b863f947ca67d510f3ab3a98cb5_JaffaCakes118.dll
Size

443KB
MD5

236c2b863f947ca67d510f3ab3a98cb5
SHA1

84e4ef453fbc173c1573cd2d313d6d8503c8b08a
SHA256

c3f7565514256ccf20bb2c1b28435aaa477b08b467c3fe6a50d5d2373693dc36
SHA512

628b45ded70025aa1535a0db5c7b6e641bdeb6e5e7ee7bc50f387c0c1a2201e96044252892deaa2bc71a7e31c6cda550f5ed3a5f1a5558ab7560b6f6c75c4c51
SSDEEP

12288:YK35C9ksO63T1ljwUmo6uH/OhZ7dV5KKNt7:YK35HTQO1dR

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3268	2388	WerFault.exe	88

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3988 wrote to memory of 2388	3988	rundll32.exe	88
PID 3988 wrote to memory of 2388	3988	rundll32.exe	88
PID 3988 wrote to memory of 2388	3988	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\236c2b863f947ca67d510f3ab3a98cb5_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3988
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\236c2b863f947ca67d510f3ab3a98cb5_JaffaCakes118.dll,#1
  2⤵
  PID:2388
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2388 -s 608
    3⤵
    - Program crash
    PID:3268

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 2388 -ip 2388
1⤵
PID:3368

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3884,i,3724086843943218842,1026644135694712596,262144 --variations-seed-version --mojo-platform-channel-handle=4356 /prefetch:8
1⤵
PID:2944