77dbe8cd2a2030dfcabba4c7d6341f21485d2cfaea40669187fa92c866a3a41f

Analysis

max time kernel
119s
max time network
129s
platform
windows7_x64
resource
win7-20240319-en
resource tags

arch:x64arch:x86image:win7-20240319-enlocale:en-usos:windows7-x64system
submitted
10-04-2024 11:44

Target

eafd7686bd1c75a1e42f6de0588a88ed_JaffaCakes118.exe
Size

328KB
MD5

eafd7686bd1c75a1e42f6de0588a88ed
SHA1

fa715f6ceeb215e8e429d81c3207e615a3b353ad
SHA256

77dbe8cd2a2030dfcabba4c7d6341f21485d2cfaea40669187fa92c866a3a41f
SHA512

cb0774d4e433eb20bc1e093c8d54c1864693c6153aa02b8dab547b27c1f1c4cba051c4dea2ab93b49ad8f050be7461c5dbb5af9d30bfdea28f24c549493b139c
SSDEEP

6144:D3kpAEjpqX1SxWY5RVhy+EASxH2skGauZnSGOrCZ31E+N/LV3D:D0pAEjZWYrVE+EAS85GdZy431LFV3D

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2804 2404 WerFault.exe regsvr32.exe

pid	pid_target	process	target process
2804	2404	WerFault.exe	regsvr32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

regsvr32.exeregsvr32.exe

description	pid	process	target process
PID 1368 wrote to memory of 2404	1368	regsvr32.exe	regsvr32.exe
PID 1368 wrote to memory of 2404	1368	regsvr32.exe	regsvr32.exe
PID 1368 wrote to memory of 2404	1368	regsvr32.exe	regsvr32.exe
PID 1368 wrote to memory of 2404	1368	regsvr32.exe	regsvr32.exe
PID 1368 wrote to memory of 2404	1368	regsvr32.exe	regsvr32.exe
PID 1368 wrote to memory of 2404	1368	regsvr32.exe	regsvr32.exe
PID 1368 wrote to memory of 2404	1368	regsvr32.exe	regsvr32.exe
PID 2404 wrote to memory of 2804	2404	regsvr32.exe	WerFault.exe
PID 2404 wrote to memory of 2804	2404	regsvr32.exe	WerFault.exe
PID 2404 wrote to memory of 2804	2404	regsvr32.exe	WerFault.exe
PID 2404 wrote to memory of 2804	2404	regsvr32.exe	WerFault.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\eafd7686bd1c75a1e42f6de0588a88ed_JaffaCakes118.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:1368

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\eafd7686bd1c75a1e42f6de0588a88ed_JaffaCakes118.exe
2⤵
- Suspicious use of WriteProcessMemory
PID:2404

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2404 -s 296
3⤵
- Program crash
PID:2804