4a4005f955ce0d96918576ce01100dd54589df25088c89e7b63109077eb6fc4f

Analysis

max time kernel
125s
max time network
134s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
09/07/2024, 10:55

Target

3017314a350e58fdcf982b7addfaf5b6_JaffaCakes118.dll
Size

93KB
MD5

3017314a350e58fdcf982b7addfaf5b6
SHA1

9f642c98f31d8e2c09ccac992d1b149b3ed999c1
SHA256

4a4005f955ce0d96918576ce01100dd54589df25088c89e7b63109077eb6fc4f
SHA512

ac852786cab6e2de45357f9aa96b591d3de18ac3fbf4e16685dd4ded202662037a950ad6f6953f219ecb5b9d4c1790c7ccf5b749ab8e1b95a12490d6d53170f3
SSDEEP

1536:5yHblcgCPIBQOicuI/dU/ZoqPsuj4QfGjOpr/nX1MBRoYHA6oR:4HbDKCoqdU/ZBEQf9MBry

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1636	2420	WerFault.exe	89

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1744 wrote to memory of 2420	1744	rundll32.exe	89
PID 1744 wrote to memory of 2420	1744	rundll32.exe	89
PID 1744 wrote to memory of 2420	1744	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3017314a350e58fdcf982b7addfaf5b6_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1744
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3017314a350e58fdcf982b7addfaf5b6_JaffaCakes118.dll,#1
  2⤵
  PID:2420
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2420 -s 684
    3⤵
    - Program crash
    PID:1636

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 2420 -ip 2420
1⤵
PID:3348

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=3804,i,5095735526234624271,6356691058050835509,262144 --variations-seed-version --mojo-platform-channel-handle=4196 /prefetch:8
1⤵
PID:4484

memory/2420-0-0x0000000010000000-0x0000000010018000-memory.dmp

Filesize
96KB

Download
memory/2420-1-0x0000000010000000-0x0000000010018000-memory.dmp

Filesize
96KB

Download