aff922a33de85fa8fa70fff7d3279a570de6ccd63a0b937876231d66b889dcca

Analysis

max time kernel
147s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
15-04-2024 17:44

Target

f1a0322b67d3d88105afe771e8e76447_JaffaCakes118.dll
Size

80KB
MD5

f1a0322b67d3d88105afe771e8e76447
SHA1

bad7faa33636c88d396f297bd5b86631c9f51a2e
SHA256

aff922a33de85fa8fa70fff7d3279a570de6ccd63a0b937876231d66b889dcca
SHA512

dc739064788da718fac3d3eaa90a6b225ec5b2107064db2a6b4c771f976ce1f2670a528f381e0a5ecdf2aafec677d71c221accb774c24dfbf07830e67b2ca804
SSDEEP

1536:x0a67zOnzwtNvKHj8Mw4HdMxjvVWMt4qwinDeqxdUx2aGuaNbWPoJK/c:+aMeqNvLMWI0+inakdUUaGusc0

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2292	4092	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3664 wrote to memory of 4092	3664	regsvr32.exe	82
PID 3664 wrote to memory of 4092	3664	regsvr32.exe	82
PID 3664 wrote to memory of 4092	3664	regsvr32.exe	82

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\f1a0322b67d3d88105afe771e8e76447_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3664
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\f1a0322b67d3d88105afe771e8e76447_JaffaCakes118.dll
  2⤵
  PID:4092
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4092 -s 568
    3⤵
    - Program crash
    PID:2292

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4092 -ip 4092
1⤵
PID:328

memory/4092-0-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download