988bc6a1cf16cb0efb65036c8aaeae4a853a55c43109cf7365d9befe4b2e1bc7

Analysis

max time kernel
95s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
10/07/2024, 03:47

Target

332f95eb0623c238f9776d0b2f4c9be2_JaffaCakes118.dll
Size

82KB
MD5

332f95eb0623c238f9776d0b2f4c9be2
SHA1

d7717b829e1615f7afc28808236b707fe8035ba2
SHA256

988bc6a1cf16cb0efb65036c8aaeae4a853a55c43109cf7365d9befe4b2e1bc7
SHA512

2a09e4d02e530a223fe957419b5fed6bbcb7b8f880111149c6eb4d4e97b770597ab7ec7c9e9d6968e224ddbe9d5c04e45505bd4a0b77b54c6ecd4009f0492023
SSDEEP

1536:tkFV+UjRbwz0pi4/C0J6WYDiVHbFCDXcb0tWcGhJW9rX:tkDBjmz0p9C0aGxeXA0bGhJW1X

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2484	2824	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4348 wrote to memory of 2824	4348	regsvr32.exe	81
PID 4348 wrote to memory of 2824	4348	regsvr32.exe	81
PID 4348 wrote to memory of 2824	4348	regsvr32.exe	81

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\332f95eb0623c238f9776d0b2f4c9be2_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4348
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\332f95eb0623c238f9776d0b2f4c9be2_JaffaCakes118.dll
  2⤵
  PID:2824
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2824 -s 604
    3⤵
    - Program crash
    PID:2484

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 2824 -ip 2824
1⤵
PID:2912

memory/2824-0-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download