bd6d09b3a509a2d53310190f20d002fc2112941349e31de6cd1eaadf5a203c78

Analysis

max time kernel
120s
max time network
50s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
01/07/2024, 14:10

Target

1b975eb28ac873278c6b82a867318775_JaffaCakes118.dll
Size

452KB
MD5

1b975eb28ac873278c6b82a867318775
SHA1

057bf5ec6f24602b3c4414fa3b3c96288c61d044
SHA256

bd6d09b3a509a2d53310190f20d002fc2112941349e31de6cd1eaadf5a203c78
SHA512

9560e9cbacfc81b315daa313620b3e395ce71f2077783613b242b76f34c02b712377c2608f66335df2879efee48a0fdc51f7c5398d3c651d4b4bb11f20d752f2
SSDEEP

12288:p2EdcBzS6sEiyj3T3Wv0y1b7FM61p/INlqFaklQTrHD5DiIlo:p2Ej6jNcb7W6n/INGaHTrHlDnl

Score

5^/10

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\regsvr32.exe	regsvr32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3648	2216	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2056 wrote to memory of 2216	2056	regsvr32.exe	81
PID 2056 wrote to memory of 2216	2056	regsvr32.exe	81
PID 2056 wrote to memory of 2216	2056	regsvr32.exe	81

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\1b975eb28ac873278c6b82a867318775_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2056
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\1b975eb28ac873278c6b82a867318775_JaffaCakes118.dll
  2⤵
  - Drops file in System32 directory
  PID:2216
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2216 -s 35392
    3⤵
    - Program crash
    PID:3648

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2216 -ip 2216
1⤵
PID:1824