d26585079898da8f41ce043d2f5beba39392b841c032ea27fe691e13ced13790

Analysis

max time kernel
122s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
18/04/2024, 10:41

Target

f7d301ad0b432858f94c301d74a0a830_JaffaCakes118.dll
Size

90KB
MD5

f7d301ad0b432858f94c301d74a0a830
SHA1

7fe80f75dadfb4e5f15b3151b100b06ad4a3e5fd
SHA256

d26585079898da8f41ce043d2f5beba39392b841c032ea27fe691e13ced13790
SHA512

3f55ade8689cf0748e73ed6223328c1697da79cbfccc81b8cd53fde978c7a8bbab653b8e8b46b2f91b1a248468a0ba4e1b2a95b6b7cc74d2674d10dd37288cf6
SSDEEP

1536:77e74KTEamqNa2lG+b26vasQ8daWPP75qETq74DpgHSKJMkIVkLyfFlG+bE:Xe7LU2l9b26isQ8lPP7F+ZFJMY2Fl9bE

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2296	4892	WerFault.exe	90

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3964 wrote to memory of 4892	3964	regsvr32.exe	90
PID 3964 wrote to memory of 4892	3964	regsvr32.exe	90
PID 3964 wrote to memory of 4892	3964	regsvr32.exe	90

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\f7d301ad0b432858f94c301d74a0a830_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3964
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\f7d301ad0b432858f94c301d74a0a830_JaffaCakes118.dll
  2⤵
  PID:4892
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4892 -s 596
    3⤵
    - Program crash
    PID:2296

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4892 -ip 4892
1⤵
PID:4264

memory/4892-0-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download