ed954217d1eade30314b031ae7266958a99fe3069d0d99f8373a932a48fb86dd

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
20/06/2024, 04:31

Target

02d17556555ae5f577be6300e4a1c998_JaffaCakes118.dll
Size

87KB
MD5

02d17556555ae5f577be6300e4a1c998
SHA1

f091ffee4faec7162f3aaeb4b40739f57e511073
SHA256

ed954217d1eade30314b031ae7266958a99fe3069d0d99f8373a932a48fb86dd
SHA512

9e8d81d8cec0703a4b829afdfd0daf739f6d224b990057260667d56e1de90361feb2c1e54058dce07dfcfb7b868f10092aeea96cfe0fb0f0963c199b79d4b9b5
SSDEEP

1536:X0IzQWqT+C/GmAvDBtvLDWzEMz9eVDrFiuJ7rXs+qEhC/z:X0jT+CNSDBtvvWHgrFiuJ7zOeC7

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3644	5112	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2128 wrote to memory of 5112	2128	regsvr32.exe	82
PID 2128 wrote to memory of 5112	2128	regsvr32.exe	82
PID 2128 wrote to memory of 5112	2128	regsvr32.exe	82

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\02d17556555ae5f577be6300e4a1c998_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2128
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\02d17556555ae5f577be6300e4a1c998_JaffaCakes118.dll
  2⤵
  PID:5112
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5112 -s 596
    3⤵
    - Program crash
    PID:3644

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5112 -ip 5112
1⤵
PID:1972

memory/5112-0-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download