8f42b2a035ec7aa4a67ac5fa744067470b80a064862f0c29f3b0f9609173551e

Analysis

max time kernel
125s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
06/07/2024, 06:45

Target

279ad992dd8be73eaffb73eea146473a_JaffaCakes118.dll
Size

101KB
MD5

279ad992dd8be73eaffb73eea146473a
SHA1

69b8a554ea7d0c818b29948269e377452e35f67d
SHA256

8f42b2a035ec7aa4a67ac5fa744067470b80a064862f0c29f3b0f9609173551e
SHA512

df284edadf16217488b004d2eaf7e7c33d952b64ddaaf1d2d16bceb0b09393a1a5ce320cd9882e3babdc0c072c17aadaac4263b3c85ccf45757befd767dd060d
SSDEEP

3072:x/fxTDipiahvuu86mZ3fdxZ2c6BcG0jIvYUNxkFF+6n:xBTGVhv386mZvdxZb62QYUU

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4428	2600	WerFault.exe	89

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4508 wrote to memory of 2600	4508	regsvr32.exe	89
PID 4508 wrote to memory of 2600	4508	regsvr32.exe	89
PID 4508 wrote to memory of 2600	4508	regsvr32.exe	89

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\279ad992dd8be73eaffb73eea146473a_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4508
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\279ad992dd8be73eaffb73eea146473a_JaffaCakes118.dll
  2⤵
  PID:2600
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2600 -s 624
    3⤵
    - Program crash
    PID:4428

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 2600 -ip 2600
1⤵
PID:4660

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4256,i,3409420486566309625,12100452682816721435,262144 --variations-seed-version --mojo-platform-channel-handle=3728 /prefetch:8
1⤵
PID:1100

memory/2600-0-0x00000000006C0000-0x0000000000706000-memory.dmp

Filesize
280KB

Download
memory/2600-1-0x00000000006C0000-0x0000000000706000-memory.dmp

Filesize
280KB

Download
memory/2600-2-0x00000000006C0000-0x0000000000706000-memory.dmp

Filesize
280KB

Download