60b9a02d40b0543ebe3f3d9a2c460300727408322649e8512348d2f2522b0140

Analysis

max time kernel
94s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
10-07-2024 08:08

Target

33e9f57d12a1ace888687c15ec8bac63_JaffaCakes118.dll
Size

353KB
MD5

33e9f57d12a1ace888687c15ec8bac63
SHA1

f2c81d8f3755a6c5efb5075bd2fde7928057215c
SHA256

60b9a02d40b0543ebe3f3d9a2c460300727408322649e8512348d2f2522b0140
SHA512

3f65ef02a648ebb0785010373a0699f215653ae8a4363513ff46eec514653766cc714a5e6558765459e6c28f589c9db8681ee5f4619d96f257b4635e6d13388e
SSDEEP

6144:c+G2ApN3wWs7SstoixXCQqwuDxtjEVQaiomytyQVU+myf2rJ7OtTtWEdN3bj1DPr:VCNbsTtoSXT0DxTa3AQe+DeE9DP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
516	2376	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2360 wrote to memory of 2376	2360	regsvr32.exe	83
PID 2360 wrote to memory of 2376	2360	regsvr32.exe	83
PID 2360 wrote to memory of 2376	2360	regsvr32.exe	83

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\33e9f57d12a1ace888687c15ec8bac63_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2360
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\33e9f57d12a1ace888687c15ec8bac63_JaffaCakes118.dll
  2⤵
  PID:2376
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2376 -s 708
    3⤵
    - Program crash
    PID:516

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 2376 -ip 2376
1⤵
PID:628

memory/2376-0-0x0000000000400000-0x0000000000501000-memory.dmp

Filesize
1.0MB

Download
memory/2376-1-0x00000000009D0000-0x00000000009D2000-memory.dmp

Filesize
8KB

Download