5180bdbe387d858843b58b1652028206ab6bbaa247882f0a4e963e5b1ff88aad

Analysis

max time kernel
147s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
21/04/2024, 07:08

Target

feb972670a23a7752047d2c2f6f3b673_JaffaCakes118.dll
Size

83KB
MD5

feb972670a23a7752047d2c2f6f3b673
SHA1

c6424cc93e85b7012ede343b07a8b57d675a20a2
SHA256

5180bdbe387d858843b58b1652028206ab6bbaa247882f0a4e963e5b1ff88aad
SHA512

67dea25d5c7f548d357984bf1a80a675fd090189f8f44b6e31f9764a5bda76b90acda641742a2cabdc2afd838d7d1f2e12ad3e5a065c80cc9ecef205f14e886d
SSDEEP

1536:PCZEGCZXQZxn6V3hnBR4ByO3BSSsTSJcKl+T6kUuzv:PEEG+gZx6VRnBihns2WKK6DuT

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1052	3472	WerFault.exe	85

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3124 wrote to memory of 3472	3124	regsvr32.exe	85
PID 3124 wrote to memory of 3472	3124	regsvr32.exe	85
PID 3124 wrote to memory of 3472	3124	regsvr32.exe	85

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\feb972670a23a7752047d2c2f6f3b673_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3124
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\feb972670a23a7752047d2c2f6f3b673_JaffaCakes118.dll
  2⤵
  PID:3472
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3472 -s 604
    3⤵
    - Program crash
    PID:1052

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 3472 -ip 3472
1⤵
PID:4800

memory/3472-0-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download