90feef81baf6f5525203c0b79a9d3df27d70a730d402779560510547b6a7c041

Analysis

max time kernel
125s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
20-06-2024 00:55

Target

018beeda537ad308adca3ab587a3c539_JaffaCakes118.dll
Size

85KB
MD5

018beeda537ad308adca3ab587a3c539
SHA1

df0eee663f45cc3e066d834073b6803b8ce39f05
SHA256

90feef81baf6f5525203c0b79a9d3df27d70a730d402779560510547b6a7c041
SHA512

f762782e5efb0355245081507c9845279b23e5c89a64f2b4ea9afa8d599ddc68fb8b2a56a7c175befdbddbc3c313a86741d3851471745e3f302bae393b1bb4c7
SSDEEP

1536:VSvmyWBUcatpRLytpID4vPQxiOEgbizdn0rYYWLsEQ1bnOk4j67QykEBzPxkuSKU:ciBzZISnUJ11714jGBzPxkuSKU

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2060	3640	WerFault.exe	89

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4548 wrote to memory of 3640	4548	regsvr32.exe	89
PID 4548 wrote to memory of 3640	4548	regsvr32.exe	89
PID 4548 wrote to memory of 3640	4548	regsvr32.exe	89

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\018beeda537ad308adca3ab587a3c539_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4548
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\018beeda537ad308adca3ab587a3c539_JaffaCakes118.dll
  2⤵
  PID:3640
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3640 -s 596
    3⤵
    - Program crash
    PID:2060

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3640 -ip 3640
1⤵
PID:2860

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=1304,i,18168883380598738769,14202261231630113808,262144 --variations-seed-version --mojo-platform-channel-handle=4256 /prefetch:8
1⤵
PID:4724

memory/3640-0-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download