c130e6d5c8698e7390a2288a296881fbebf9458cca4f4629171f1d50afc64ef8

Analysis

max time kernel
125s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
20/06/2024, 09:55

Target

04ee895a74b038e693998bb87e154508_JaffaCakes118.dll
Size

90KB
MD5

04ee895a74b038e693998bb87e154508
SHA1

2d27a979a08cdb5862abce18dae197651992d6ba
SHA256

c130e6d5c8698e7390a2288a296881fbebf9458cca4f4629171f1d50afc64ef8
SHA512

4bf2f0413bed51c5a5a1634825e134e1b8971ed901da174119fd27fce67633e70290b1ed9520dc788d0632e15c98017086b18dbce9c26ee9c527b6bcc86318c7
SSDEEP

1536:YaOWqfXFStlTV9fp7YxzwSkaT8ynDPa6Npf5zQFsyscNM/11StqtmPxI0/GuhjSE:YaOWAFSfV9fRwtrDPVpUA1StLG0/jcE

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1608	428	WerFault.exe	89

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 316 wrote to memory of 428	316	regsvr32.exe	89
PID 316 wrote to memory of 428	316	regsvr32.exe	89
PID 316 wrote to memory of 428	316	regsvr32.exe	89

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\04ee895a74b038e693998bb87e154508_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:316
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\04ee895a74b038e693998bb87e154508_JaffaCakes118.dll
  2⤵
  PID:428
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 428 -s 596
    3⤵
    - Program crash
    PID:1608

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 428 -ip 428
1⤵
PID:3540

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4168,i,1697479186275492802,18058102846092193784,262144 --variations-seed-version --mojo-platform-channel-handle=4292 /prefetch:8
1⤵
PID:2656

memory/428-0-0x0000000000A00000-0x0000000000A46000-memory.dmp

Filesize
280KB

Download