4905f97daf60b2c69c6a5f5148a503dd2bb7fabe8f7e37e87f1de9659092f3ac

Analysis

max time kernel
149s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
12/10/2026, 19:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_Trojan-Clicker.Win32.AdClicer.b.dll
Size 48KB
Sample261012-xz7cmsd161
SHA256 4905f97daf60b2c69c6a5f5148a503dd2bb7fabe8f7e37e87f1de9659092f3ac
MD5 cdc4ef7f99502fa43370fcdce4e6503a
SHA1 472348cb0e6dc884eca9a6b9cc11c89def559290
SHA512 bec7c0725ef1d249f95d8eef5a6ec3a1fe5f79f55da2c84b6ab6c188b17129c47c6e2f1aee5404884f67e5fe2a9ad085a403fc164798f1a8339d82ea7aca5066
SSDEEP 768:KrY2Z1EDhOFQjkVNOSPPLLKnpJjn1LyC8p0+mtGAMoci/mU5QyLP20Pa2KJJRT6:w/4DYyjkxP/Cj1mCJEroSwT7gT6
TLSH
T1BD23F1EE9616019DC13AEEB8DA3C9537F65246490AC5553F338119C911FB02D3AEAC3B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4456	1768	WerFault.exe	85

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3524 wrote to memory of 1768	3524	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Clicker.Win32.AdClicer.b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3524
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Clicker.Win32.AdClicer.b.dll,#1
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1768
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1768 -s 544
    3⤵
    - Program crash
    PID:4456

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1768 -ip 1768
1⤵
PID:4932

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1768-0-0x0000000010000000-0x000000001001D000-memory.dmp

Download