2d9b563c7588bee5501445e7a1624da8c3243e9e5f3871b6b2a30bf572c2c925

Analysis

max time kernel
142s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
19-04-2024 16:07

Target

faaa5601ec7ca180dfe511554a872293_JaffaCakes118.dll
Size

79KB
MD5

faaa5601ec7ca180dfe511554a872293
SHA1

07b8c1c9ccbf8f84ebe6e7ac244efe8712e13d08
SHA256

2d9b563c7588bee5501445e7a1624da8c3243e9e5f3871b6b2a30bf572c2c925
SHA512

999302fcc2f6baf7e2ef366e802c1530335f8228b0eb006f73402b4950e8e0fa2ef56c67114a56731fc2f36c1372e979c91566375cc6a8af53ea7c880e8c3376
SSDEEP

1536:lbDmi+0YduImNuB8CbtkRHwpb1TUcI5kVQGawQuD0tkArxMs8KaAmqnaQ:AKYsFNvCbtx7PcHgcRlX/naQ

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
680	4256	WerFault.exe	92

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4820 wrote to memory of 4256	4820	regsvr32.exe	92
PID 4820 wrote to memory of 4256	4820	regsvr32.exe	92
PID 4820 wrote to memory of 4256	4820	regsvr32.exe	92

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\faaa5601ec7ca180dfe511554a872293_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4820
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\faaa5601ec7ca180dfe511554a872293_JaffaCakes118.dll
  2⤵
  PID:4256
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4256 -s 596
    3⤵
    - Program crash
    PID:680

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4256 -ip 4256
1⤵
PID:4260

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3956 --field-trial-handle=2328,i,5873823382323802923,13134441441264702821,262144 --variations-seed-version /prefetch:8
1⤵
PID:4412

memory/4256-0-0x0000000000770000-0x00000000007AF000-memory.dmp

Filesize
252KB

Download