512e189e1b413c49e597a973fe27778ccd2897ced09873780d33a5b748b9aa09

Analysis

max time kernel
130s
max time network
134s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
08/07/2024, 14:37

Target

2cb86117faa644d7d6c0eb2278645e2c_JaffaCakes118.dll
Size

57KB
MD5

2cb86117faa644d7d6c0eb2278645e2c
SHA1

a71bac4118d3f2bdc2ab047204cac76e1e027ffa
SHA256

512e189e1b413c49e597a973fe27778ccd2897ced09873780d33a5b748b9aa09
SHA512

3c8e72cc37ca8ff028dcfc527f52dd81081b58637a4f36550ecda19f5748d569d3bc995b3b0b2925ecf28d930dee2cd4ab8022ccb95856ef38aecb8e82b556d6
SSDEEP

1536:LtbQ12PUu9bZjOU4PTex7MV30WLkn5kV+4X6+u2ODMd:LtbQ16UGljOPTex783YnaVo+xd

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1972	3612	WerFault.exe	89

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4236 wrote to memory of 3612	4236	rundll32.exe	89
PID 4236 wrote to memory of 3612	4236	rundll32.exe	89
PID 4236 wrote to memory of 3612	4236	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2cb86117faa644d7d6c0eb2278645e2c_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4236
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2cb86117faa644d7d6c0eb2278645e2c_JaffaCakes118.dll,#1
  2⤵
  PID:3612
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3612 -s 728
    3⤵
    - Program crash
    PID:1972

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3612 -ip 3612
1⤵
PID:4084

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4356,i,3027467512973953085,11878940668304988630,262144 --variations-seed-version --mojo-platform-channel-handle=4060 /prefetch:8
1⤵
PID:1664

memory/3612-0-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/3612-1-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/3612-2-0x0000000000AB0000-0x0000000000AB1000-memory.dmp

Filesize
4KB

Download
memory/3612-3-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download