16ef1af47ee665aa11fcd5346bd194aa321302c4e9677c9e2231a5aadec1b7b5

Analysis

max time kernel
94s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
08/07/2024, 08:32

Target

2baa31641b1a6494c4b71358c2eb89e6_JaffaCakes118.dll
Size

156KB
MD5

2baa31641b1a6494c4b71358c2eb89e6
SHA1

8d63d115695fec95d8d56794d9aef134937abf75
SHA256

16ef1af47ee665aa11fcd5346bd194aa321302c4e9677c9e2231a5aadec1b7b5
SHA512

85c1906d5216d0c061d2a78a2855f82dca90176763d059fc157b40f6be1a1b2ef171d52cce354d3e13776f31bdcbd8040f7dded8a08fcf940ed6a0607fc13c2e
SSDEEP

3072:w714bkuu9fuB6puxb/l0dZ8/LG42X8ZxrmkM3QilDWgLycrXDQrE3nn:wR4vmeMu/0zcWX8ZxKdQM7X

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4524	776	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4136 wrote to memory of 776	4136	regsvr32.exe	82
PID 4136 wrote to memory of 776	4136	regsvr32.exe	82
PID 4136 wrote to memory of 776	4136	regsvr32.exe	82

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\2baa31641b1a6494c4b71358c2eb89e6_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4136
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\2baa31641b1a6494c4b71358c2eb89e6_JaffaCakes118.dll
  2⤵
  PID:776
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 776 -s 648
    3⤵
    - Program crash
    PID:4524

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 776 -ip 776
1⤵
PID:1688