d0225f908e2c94bc800ceebc329dcb88bb440270a930529cbc45e42a2f0338ce

Analysis

max time kernel
92s
max time network
93s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
04/07/2024, 09:49

Target

25812f47a0712cebd1123bdfc7902a9e_JaffaCakes118.dll
Size

130KB
MD5

25812f47a0712cebd1123bdfc7902a9e
SHA1

63b74591c8d9959a0e0532bfca72275b619dbf9f
SHA256

d0225f908e2c94bc800ceebc329dcb88bb440270a930529cbc45e42a2f0338ce
SHA512

8706f18d6695422b43795cecb2daa4156eb5accdb4dcefec817948e5e31d5bf3e186e8d35caf593265ac733eb80a77cfcc4b00bbac649cad31d2252376ddf4ae
SSDEEP

3072:dZ5s3T54P9WG5yjwEVU4Ra1iixSHrTs0sSx8BFSR:PmTGlb2wE5a4Gq/x8B

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4296	3828	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 740 wrote to memory of 3828	740	regsvr32.exe	81
PID 740 wrote to memory of 3828	740	regsvr32.exe	81
PID 740 wrote to memory of 3828	740	regsvr32.exe	81

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\25812f47a0712cebd1123bdfc7902a9e_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:740
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\25812f47a0712cebd1123bdfc7902a9e_JaffaCakes118.dll
  2⤵
  PID:3828
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3828 -s 664
    3⤵
    - Program crash
    PID:4296

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3828 -ip 3828
1⤵
PID:3672

memory/3828-0-0x0000000010000000-0x000000001006B000-memory.dmp

Filesize
428KB

Download