c8f6e28bb3c7a18b70f74e9bd809a7665f8d1f6ac1d9f847da5cd750d3baa768

Analysis

max time kernel
140s
max time network
120s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
03/07/2024, 22:56

Target

23bffa301e79d083659bf0dcad4f511f_JaffaCakes118.dll
Size

1.2MB
MD5

23bffa301e79d083659bf0dcad4f511f
SHA1

aee3667555306719c6fbee5b9211f20d97d06ef1
SHA256

c8f6e28bb3c7a18b70f74e9bd809a7665f8d1f6ac1d9f847da5cd750d3baa768
SHA512

3f85126ad6d88d6b2c7771e5908ce39789ecf0bce4490809261dca203ea60c1f27157fa2f3d5563888ceac83989ea645ee304d628daf945552d31b3b29c75ad9
SSDEEP

24576:yjoCdZc7lNQl2iYA6/t7EO+JBWvxMF48SWYvFvYb+uh:yzdZ+u2j/t7uJMveYvtYP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2636	2316	WerFault.exe	28

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2316	regsvr32.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2028 wrote to memory of 2316	2028	regsvr32.exe	28
PID 2028 wrote to memory of 2316	2028	regsvr32.exe	28
PID 2028 wrote to memory of 2316	2028	regsvr32.exe	28
PID 2028 wrote to memory of 2316	2028	regsvr32.exe	28
PID 2028 wrote to memory of 2316	2028	regsvr32.exe	28
PID 2028 wrote to memory of 2316	2028	regsvr32.exe	28
PID 2028 wrote to memory of 2316	2028	regsvr32.exe	28
PID 2316 wrote to memory of 2636	2316	regsvr32.exe	29
PID 2316 wrote to memory of 2636	2316	regsvr32.exe	29
PID 2316 wrote to memory of 2636	2316	regsvr32.exe	29
PID 2316 wrote to memory of 2636	2316	regsvr32.exe	29

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\23bffa301e79d083659bf0dcad4f511f_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2028
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\23bffa301e79d083659bf0dcad4f511f_JaffaCakes118.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2316
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2316 -s 460
    3⤵
    - Program crash
    PID:2636

memory/2316-0-0x0000000002290000-0x00000000023CB000-memory.dmp

Filesize
1.2MB

Download
memory/2316-1-0x0000000001D90000-0x0000000001E72000-memory.dmp

Filesize
904KB

Download
memory/2316-2-0x0000000002291000-0x0000000002295000-memory.dmp

Filesize
16KB

Download
memory/2316-3-0x0000000002290000-0x00000000023CB000-memory.dmp

Filesize
1.2MB

Download
memory/2316-4-0x00000000001B0000-0x00000000001B7000-memory.dmp

Filesize
28KB

Download