128ae016129741fcb2a6f992001b14e647dfb551045a4576e0dbd9996b293f67

Analysis

max time kernel
92s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
01/07/2024, 17:38

Target

1be8586b3f39757f07c337dfc369bfb2_JaffaCakes118.dll
Size

80KB
MD5

1be8586b3f39757f07c337dfc369bfb2
SHA1

8db6ab3f8f15ef381282dd7da5a72e510e5cf43a
SHA256

128ae016129741fcb2a6f992001b14e647dfb551045a4576e0dbd9996b293f67
SHA512

e1eeb5c201e8df8dc0ce6a6e89bc18a197984e0a8b837f638b9a434197b8c7b3fd4da4997eacd3353de9902ebc573df023e3296c0376057367e87ef711e45e42
SSDEEP

1536:+c78EEwU6LCmMYG5WXW1fFnqeFs0SzCqqEV+eFXenwGvfogd9MYG0:+q8jv6XWpFnqem0SzXnl9ywGvLX

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2860	2972	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4172 wrote to memory of 2972	4172	regsvr32.exe	81
PID 4172 wrote to memory of 2972	4172	regsvr32.exe	81
PID 4172 wrote to memory of 2972	4172	regsvr32.exe	81

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\1be8586b3f39757f07c337dfc369bfb2_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4172
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\1be8586b3f39757f07c337dfc369bfb2_JaffaCakes118.dll
  2⤵
  PID:2972
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2972 -s 596
    3⤵
    - Program crash
    PID:2860

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 2972 -ip 2972
1⤵
PID:3324

memory/2972-0-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download