1aba3c877a8bdae0b089fd71b252953866bc127f8da12b8ba49d5ad68241985b

Analysis

max time kernel
142s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
03/07/2024, 13:42

Target

228cde4a17d10c7efd416c2842bdfe6e_JaffaCakes118.dll
Size

80KB
MD5

228cde4a17d10c7efd416c2842bdfe6e
SHA1

fff40eaf6441a45d152013407cf728c3516de570
SHA256

1aba3c877a8bdae0b089fd71b252953866bc127f8da12b8ba49d5ad68241985b
SHA512

ee42aac1ece9ab95216cd9e15c7ef9a878a2ae060f8ee021561415b3402ca17ef74955c5c72b021d5b7ba9086ab37b7c9ca9e651c188e9d3a750fdf75c776aa9
SSDEEP

1536:prCPwhzE3HsjfmOI6v3PA6cUCRI8PKauv0APCl+RvODAdEjNHwl5UBOv:FrhsHsLTvfaUCG1xvTvRuAejNHGUB2

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4368	3048	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4408 wrote to memory of 3048	4408	regsvr32.exe	83
PID 4408 wrote to memory of 3048	4408	regsvr32.exe	83
PID 4408 wrote to memory of 3048	4408	regsvr32.exe	83

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\228cde4a17d10c7efd416c2842bdfe6e_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4408
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\228cde4a17d10c7efd416c2842bdfe6e_JaffaCakes118.dll
  2⤵
  PID:3048
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3048 -s 596
    3⤵
    - Program crash
    PID:4368

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3048 -ip 3048
1⤵
PID:1856

memory/3048-1-0x0000000002620000-0x000000000265F000-memory.dmp

Filesize
252KB

Download
memory/3048-0-0x0000000002620000-0x000000000265F000-memory.dmp

Filesize
252KB

Download