7d51522a9e04caabc3563614ffb6aa75b0135c746ffd9bf0c26a4de0b8f27ba6

Analysis

max time kernel
92s
max time network
114s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
18/04/2024, 18:49

Target

f88b42153594cfd966dc7e9eb7f036a7_JaffaCakes118.dll
Size

89KB
MD5

f88b42153594cfd966dc7e9eb7f036a7
SHA1

f9980d9e49afb4e6fcc33bd34bdad43874295c73
SHA256

7d51522a9e04caabc3563614ffb6aa75b0135c746ffd9bf0c26a4de0b8f27ba6
SHA512

102a0dd4889cdaa4f754e28c97d2cb21697a601f7c8e2fc84ddd18eae582be0a208316a37a77400d4b4caeecffab75928e238f029ac60e57e0f00f4f77443bdc
SSDEEP

1536:UrdUsl0mi6MGPLt909g4vD333wcfUjoIvKr2Gzb1aVkYqF5AolOmmB5qzGKlGg9f:UFlli6H9ELvL3nfwoICK0bIVkTnYmg5w

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3172	3556	WerFault.exe	86

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 948 wrote to memory of 3556	948	regsvr32.exe	86
PID 948 wrote to memory of 3556	948	regsvr32.exe	86
PID 948 wrote to memory of 3556	948	regsvr32.exe	86

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\f88b42153594cfd966dc7e9eb7f036a7_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:948
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\f88b42153594cfd966dc7e9eb7f036a7_JaffaCakes118.dll
  2⤵
  PID:3556
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3556 -s 596
    3⤵
    - Program crash
    PID:3172

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3556 -ip 3556
1⤵
PID:2664

memory/3556-0-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download