bd1285aef374b343e6fa66a13aba8bfa96b9221f478f7f7cf49deb148b92db69

Analysis

max time kernel
92s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
06/04/2024, 12:14

Target

e2855c9cb8354aef0961dce7680a8040_JaffaCakes118.dll
Size

100KB
MD5

e2855c9cb8354aef0961dce7680a8040
SHA1

a4da12568462e6307aced728d0ee1ec4c1884357
SHA256

bd1285aef374b343e6fa66a13aba8bfa96b9221f478f7f7cf49deb148b92db69
SHA512

47018cf9b141d81bf524f7c7391648e77577343d786c4ef73b107e3a1839979526588f9dc1bf98d90a31a09e126ef0e7d1e687427923fd1b312b8b79ac59c23a
SSDEEP

3072:/Z6Vyan9b5rKYWjTcR0Sds17BcoD7cnbR/V8:4Jnx5Kjo0BooDQnbd

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3260	1160	WerFault.exe	86

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1408 wrote to memory of 1160	1408	regsvr32.exe	86
PID 1408 wrote to memory of 1160	1408	regsvr32.exe	86
PID 1408 wrote to memory of 1160	1408	regsvr32.exe	86

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\e2855c9cb8354aef0961dce7680a8040_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1408
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\e2855c9cb8354aef0961dce7680a8040_JaffaCakes118.dll
  2⤵
  PID:1160
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1160 -s 616
    3⤵
    - Program crash
    PID:3260

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1160 -ip 1160
1⤵
PID:3600

memory/1160-0-0x0000000000550000-0x0000000000596000-memory.dmp

Filesize
280KB

Download