8c755189e3e3f0c8a5a99ccf799b52e666c4f443a76bbb708e789c7585f129a6

Analysis

max time kernel
51s
max time network
51s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
20/06/2024, 07:22

Target

03fcc2413a78ef5ad1d7229ebef1c65a_JaffaCakes118.dll
Size

158KB
MD5

03fcc2413a78ef5ad1d7229ebef1c65a
SHA1

fe0550d07fe5d1ab4dd5a2f9aedc65102a81242b
SHA256

8c755189e3e3f0c8a5a99ccf799b52e666c4f443a76bbb708e789c7585f129a6
SHA512

7b656d604195129f0f64cfefe7e628e582fa266f39c73bf5d47a29a490edd992a10eb5e44b98cde8fe11243a501d68a6b3ab61ab33d50a1c70f2f24522bce690
SSDEEP

3072:iIxWhefJsNMp3KxRTRqfUfGorEsMsIg1cjAp:iIxrfiNgaTRUUfGogkT

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1612	2320	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4816 wrote to memory of 2320	4816	regsvr32.exe	82
PID 4816 wrote to memory of 2320	4816	regsvr32.exe	82
PID 4816 wrote to memory of 2320	4816	regsvr32.exe	82

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\03fcc2413a78ef5ad1d7229ebef1c65a_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4816
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\03fcc2413a78ef5ad1d7229ebef1c65a_JaffaCakes118.dll
  2⤵
  PID:2320
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2320 -s 596
    3⤵
    - Program crash
    PID:1612

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 2320 -ip 2320
1⤵
PID:2788

memory/2320-0-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download