f298f306cd5d4156a5654ebf76c26181689241992d1c1de0b027a59258afd27e

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
10/07/2024, 02:06

Target

32e83249347156c55d28ff0051814db2_JaffaCakes118.dll
Size

82KB
MD5

32e83249347156c55d28ff0051814db2
SHA1

bb8e1e0132c5460efe6c3c4634edda56684286e9
SHA256

f298f306cd5d4156a5654ebf76c26181689241992d1c1de0b027a59258afd27e
SHA512

7f8324b01d8849f0cc7412d7ff92e203a4e70ad316dbd7da92444cecb6753e0e79efa628092018b5b6e2336a57277a6bf38539dc14c882c9318b3883fec97f2f
SSDEEP

1536:QQ+2Ful5zRJvE9hPqGPb2j2H3Qx4UDytx1Dnge929ICplmt6XSlZbY:QQ+xXrvIUGPr43DyVX92Pp4t6CZU

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2160	1664	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2096 wrote to memory of 1664	2096	regsvr32.exe	81
PID 2096 wrote to memory of 1664	2096	regsvr32.exe	81
PID 2096 wrote to memory of 1664	2096	regsvr32.exe	81

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\32e83249347156c55d28ff0051814db2_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2096
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\32e83249347156c55d28ff0051814db2_JaffaCakes118.dll
  2⤵
  PID:1664
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1664 -s 608
    3⤵
    - Program crash
    PID:2160

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1664 -ip 1664
1⤵
PID:4308

memory/1664-0-0x0000000000DC0000-0x0000000000DFF000-memory.dmp

Filesize
252KB

Download