130203abf5c9e5af5d598f8a190457a7298735e07d7b0c43a8793c82e6fd7d67

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
27/06/2024, 17:36

Target

16e44c67735c68ccf78eb60abf0a2b5e_JaffaCakes118.dll
Size

80KB
MD5

16e44c67735c68ccf78eb60abf0a2b5e
SHA1

b337cb89d3b71e71d6da340135c5e704a1326db8
SHA256

130203abf5c9e5af5d598f8a190457a7298735e07d7b0c43a8793c82e6fd7d67
SHA512

41bf087f32a40f31984623df98307048ced8ff74ca5b2f9d0955ace00159847f271a8fe527e55787ebad21982697134be645ceff9a36dd16192b78e26c9c2f31
SSDEEP

1536:HwUPYbB9fyHuX05mBTJxu1UjQ+0KJGUOgbOT2MKAyj+V+P:QUwbBlyHuX0U9xuWQ/KJgqaKvW+P

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4656	3140	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2688 wrote to memory of 3140	2688	regsvr32.exe	81
PID 2688 wrote to memory of 3140	2688	regsvr32.exe	81
PID 2688 wrote to memory of 3140	2688	regsvr32.exe	81

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\16e44c67735c68ccf78eb60abf0a2b5e_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2688
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\16e44c67735c68ccf78eb60abf0a2b5e_JaffaCakes118.dll
  2⤵
  PID:3140
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3140 -s 596
    3⤵
    - Program crash
    PID:4656

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3140 -ip 3140
1⤵
PID:1208

memory/3140-1-0x00000000007C0000-0x00000000007FE000-memory.dmp

Filesize
248KB

Download
memory/3140-0-0x00000000007C0000-0x00000000007FE000-memory.dmp

Filesize
248KB

Download