93e4fd0a1d8266103c2d40aa31775eaba0911a5ad2b71da0ca2a49af8223757f

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
10/07/2024, 04:39

Target

33536c5b199289ec8988d501fa9a1338_JaffaCakes118.dll
Size

83KB
MD5

33536c5b199289ec8988d501fa9a1338
SHA1

f748ab72ccbdeadde4dc1a0fcd9a11089e8f1021
SHA256

93e4fd0a1d8266103c2d40aa31775eaba0911a5ad2b71da0ca2a49af8223757f
SHA512

ee05de54b0fc6b8e3b6ff40b9efb274330ba6a5a5f6f2fae06bdeeceb416d72169da157e6c084a91580edf58145871693c255014644b17a8d29391955206b2a3
SSDEEP

1536:rSOMRJcRXodBhCA66v0gRPF0h8k79Pl5E0HW6rA8bnX+xiSfZnfAlLgDnhXMc:GVKRWhCt6vjRPFidkS/ShXyc

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1712	3272	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1040 wrote to memory of 3272	1040	regsvr32.exe	81
PID 1040 wrote to memory of 3272	1040	regsvr32.exe	81
PID 1040 wrote to memory of 3272	1040	regsvr32.exe	81

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\33536c5b199289ec8988d501fa9a1338_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1040
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\33536c5b199289ec8988d501fa9a1338_JaffaCakes118.dll
  2⤵
  PID:3272
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3272 -s 596
    3⤵
    - Program crash
    PID:1712

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3272 -ip 3272
1⤵
PID:1536

memory/3272-0-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download