244ed5ec238b329425bcf7a08bd3ea6bd8ef0f52990711fdf6da169afd3d773b

Analysis

max time kernel
125s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
08-07-2024 14:47

Target

2cbee9c7b8d2684a5bac7811e3aac94e_JaffaCakes118.dll
Size

78KB
MD5

2cbee9c7b8d2684a5bac7811e3aac94e
SHA1

9255c2f6d20e5b56b74f40bd91cd0fcf77b1480c
SHA256

244ed5ec238b329425bcf7a08bd3ea6bd8ef0f52990711fdf6da169afd3d773b
SHA512

2aa3200454b58b32fe98bea4106bbed892a710b5c3b2335ebb8195d8e466cd1a1483646faf56bf25c99a7602d6e1e18bcd012d7543b0b70945d8e1cd9f9867ac
SSDEEP

1536:BMMObIsZaUQxJUHmoW7qhWnGMn3jO1cdooaAoodtmTFwuQi16mlD:iNERpxJUiWY40aBMtmZBt

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3828	2600	WerFault.exe	89

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4508 wrote to memory of 2600	4508	rundll32.exe	89
PID 4508 wrote to memory of 2600	4508	rundll32.exe	89
PID 4508 wrote to memory of 2600	4508	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2cbee9c7b8d2684a5bac7811e3aac94e_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4508
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2cbee9c7b8d2684a5bac7811e3aac94e_JaffaCakes118.dll,#1
  2⤵
  PID:2600
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2600 -s 584
    3⤵
    - Program crash
    PID:3828

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2600 -ip 2600
1⤵
PID:3648

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4032,i,3409420486566309625,12100452682816721435,262144 --variations-seed-version --mojo-platform-channel-handle=4248 /prefetch:8
1⤵
PID:4640

memory/2600-0-0x0000000010000000-0x0000000010027000-memory.dmp

Filesize
156KB

Download