39cf08802b86a1c87790f7b1522b98d6ccfad6d2cce9eda75d9805e8795a7850

Analysis

max time kernel
140s
max time network
122s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
06/07/2024, 10:32

Target

283b6bee3acdd3ac5e34b4d879e07c15_JaffaCakes118.dll
Size

531KB
MD5

283b6bee3acdd3ac5e34b4d879e07c15
SHA1

9f28748b25445ba303d566f9b35e5ef61819801f
SHA256

39cf08802b86a1c87790f7b1522b98d6ccfad6d2cce9eda75d9805e8795a7850
SHA512

9aca18a257bf3ae206027c18fcfb962229937f457a5c00c167eb660ef3b84dc3f35396ff8de808521efb41fc97908c67db75d84744abda3c3d65a5a45e6f4f69
SSDEEP

12288:y1D8HuJuysLILb3Gg/4yVHpD7FKkE6LXyATIr:eqFDLI/2gBNpD7FKkE6LiAa

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2420	2168	WerFault.exe	30

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1656 wrote to memory of 2168	1656	regsvr32.exe	30
PID 1656 wrote to memory of 2168	1656	regsvr32.exe	30
PID 1656 wrote to memory of 2168	1656	regsvr32.exe	30
PID 1656 wrote to memory of 2168	1656	regsvr32.exe	30
PID 1656 wrote to memory of 2168	1656	regsvr32.exe	30
PID 1656 wrote to memory of 2168	1656	regsvr32.exe	30
PID 1656 wrote to memory of 2168	1656	regsvr32.exe	30
PID 2168 wrote to memory of 2420	2168	regsvr32.exe	31
PID 2168 wrote to memory of 2420	2168	regsvr32.exe	31
PID 2168 wrote to memory of 2420	2168	regsvr32.exe	31
PID 2168 wrote to memory of 2420	2168	regsvr32.exe	31

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\283b6bee3acdd3ac5e34b4d879e07c15_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1656
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\283b6bee3acdd3ac5e34b4d879e07c15_JaffaCakes118.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2168
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2168 -s 340
    3⤵
    - Program crash
    PID:2420

memory/2168-0-0x00000000001F0000-0x000000000027B000-memory.dmp

Filesize
556KB

Download
memory/2168-1-0x00000000001F0000-0x000000000027B000-memory.dmp

Filesize
556KB

Download