855ca22320f1284d3de551466d7e31730b8d89eca79100e33681fd913670df10

Analysis

max time kernel
149s
max time network
164s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
08/07/2024, 12:36

Target

2c5ee5c6705e7d4cf8d62f5264c239db_JaffaCakes118.dll
Size

85KB
MD5

2c5ee5c6705e7d4cf8d62f5264c239db
SHA1

1a9289564fa9b1d044a36c9c40a45cbb3954464a
SHA256

855ca22320f1284d3de551466d7e31730b8d89eca79100e33681fd913670df10
SHA512

bbf660316a46af5d622fbd8fa016801509e64861e9cd9973d343d18e6f019f954513510077f9cf00c3c908812aeff845a5c7f6f5c69f52d83e96f94ab1af3be4
SSDEEP

1536:wTnDhFjclsWVM3p3VME/9wBL1Ze66jP5BHdSZBKglJFrVzdbDWKmYkE95r:wDDLcj2plMEOpjIkZBFlBdbDWKrkEX

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4880	3928	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2604 wrote to memory of 3928	2604	regsvr32.exe	82
PID 2604 wrote to memory of 3928	2604	regsvr32.exe	82
PID 2604 wrote to memory of 3928	2604	regsvr32.exe	82

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\2c5ee5c6705e7d4cf8d62f5264c239db_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2604
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\2c5ee5c6705e7d4cf8d62f5264c239db_JaffaCakes118.dll
  2⤵
  PID:3928
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3928 -s 600
    3⤵
    - Program crash
    PID:4880

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3928 -ip 3928
1⤵
PID:4964

memory/3928-0-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download