4722c931b77df34d88b503b96f15e8912ed4372f45d2e9bfdaf35588e0ac9e0a

Analysis

max time kernel
94s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
04-07-2024 18:52

Target

25dee50598d39fc61dd8170b95a707d6_JaffaCakes118.dll
Size

76KB
MD5

25dee50598d39fc61dd8170b95a707d6
SHA1

aed389b44d9b0d8a218f2965965b0ec970141860
SHA256

4722c931b77df34d88b503b96f15e8912ed4372f45d2e9bfdaf35588e0ac9e0a
SHA512

92eb0266d4995fa18843d58c505763010157f8f871780bdf4bcd0b9f433327f30025e098c4cfde9ebbd5b547c929749938906fc31f9c3d879782063ca405b03c
SSDEEP

1536:80FQKCHsTklkGiaSvbM8TPqo3ud7zlmce:LQKC0k2Gi7bwo3Sl0

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3684	1944	WerFault.exe	78

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1220 wrote to memory of 1944	1220	regsvr32.exe	78
PID 1220 wrote to memory of 1944	1220	regsvr32.exe	78
PID 1220 wrote to memory of 1944	1220	regsvr32.exe	78

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\25dee50598d39fc61dd8170b95a707d6_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1220
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\25dee50598d39fc61dd8170b95a707d6_JaffaCakes118.dll
  2⤵
  PID:1944
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1944 -s 628
    3⤵
    - Program crash
    PID:3684

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 1944 -ip 1944
1⤵
PID:3924