52533ac0dfcdffbb141f86465fbfdb6be47ecc260d2995c17db47393a6cbfb93

Analysis

max time kernel
133s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
25-06-2024 20:08

Target

0f5db0aebac0347ce524c39b07cd0d8b_JaffaCakes118.dll
Size

589KB
MD5

0f5db0aebac0347ce524c39b07cd0d8b
SHA1

559831d892a32bb152738b55d17bd4f63cdc2504
SHA256

52533ac0dfcdffbb141f86465fbfdb6be47ecc260d2995c17db47393a6cbfb93
SHA512

7b0f9559c275d42e7fecec3629a297eb565ab83dc3b69b0d13417ffbed830b1046ce650297a8d954a279150922a0ca5e4125835441899eac71dad0938e0e7a42
SSDEEP

6144:1VYHw+CkjBeH2MNaFdTRLSO20Oc40jtO0IpCJM93d5ox1AictU49CW:vYHwfCa22E4l4xkyW

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
640	3260	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1480 wrote to memory of 3260	1480	regsvr32.exe	83
PID 1480 wrote to memory of 3260	1480	regsvr32.exe	83
PID 1480 wrote to memory of 3260	1480	regsvr32.exe	83

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\0f5db0aebac0347ce524c39b07cd0d8b_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1480
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\0f5db0aebac0347ce524c39b07cd0d8b_JaffaCakes118.dll
  2⤵
  PID:3260
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3260 -s 696
    3⤵
    - Program crash
    PID:640

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 3260 -ip 3260
1⤵
PID:4028

memory/3260-0-0x000000004F890000-0x000000004F926000-memory.dmp

Filesize
600KB

Download