6cfe6ff4d8d31a0a6dd80b6dbab2665c6048ea5a6632caf241f4e86667ffa173

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
08/07/2024, 17:18

Target

2d2cae6d76b727d98e12c9c2d0676f17_JaffaCakes118.dll
Size

158KB
MD5

2d2cae6d76b727d98e12c9c2d0676f17
SHA1

7d832ad79e1ba823365fe16324d8b8a46961ea6f
SHA256

6cfe6ff4d8d31a0a6dd80b6dbab2665c6048ea5a6632caf241f4e86667ffa173
SHA512

a6cc622c24d86dcd77c8b1cdc8fe0ec8b68a043736ae6dc8ff4a37e6e6f8a3e1ee59e02454d4cb2aaea81f3fa6adc10b21328c589224d74dfb295bd621c33a54
SSDEEP

3072:1//VMwqBkfIs6rzszUbt//B8xd9279Zjf5W6r:l/VbqBKIs68a//B6AA6

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1648	3828	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1364 wrote to memory of 3828	1364	regsvr32.exe	82
PID 1364 wrote to memory of 3828	1364	regsvr32.exe	82
PID 1364 wrote to memory of 3828	1364	regsvr32.exe	82

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\2d2cae6d76b727d98e12c9c2d0676f17_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1364
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\2d2cae6d76b727d98e12c9c2d0676f17_JaffaCakes118.dll
  2⤵
  PID:3828
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3828 -s 596
    3⤵
    - Program crash
    PID:1648

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3828 -ip 3828
1⤵
PID:3232

memory/3828-0-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download