810541afa7f0b98d61e978a2e830ae3a93c15dfc51af397801b1c7ec3be6b37b

Analysis

max time kernel
15s
max time network
19s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
11-07-2024 03:46

Target

37966aa26ddabc9a2ad9c3043ec07b0b_JaffaCakes118.dll
Size

156KB
MD5

37966aa26ddabc9a2ad9c3043ec07b0b
SHA1

817fd20a1ca6ee2bd973409033e2fee2f81eac57
SHA256

810541afa7f0b98d61e978a2e830ae3a93c15dfc51af397801b1c7ec3be6b37b
SHA512

4a49bd0873135e6ae6a5c1aa2d81634f3accdc688d4c826212eda6ae638d5999189ce2bbacc6f5aef1ecc07c061707d85c8baa77779ed657aa093b0569f779d0
SSDEEP

3072:kuhE6zRkEC1C9n2T5JEW9ytOHsHYRf9gNR5hXRzJrvC:kuh1C1XXmYRFgNXtrvC

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2136	1948	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2240 wrote to memory of 1948	2240	regsvr32.exe	28
PID 2240 wrote to memory of 1948	2240	regsvr32.exe	28
PID 2240 wrote to memory of 1948	2240	regsvr32.exe	28
PID 2240 wrote to memory of 1948	2240	regsvr32.exe	28
PID 2240 wrote to memory of 1948	2240	regsvr32.exe	28
PID 2240 wrote to memory of 1948	2240	regsvr32.exe	28
PID 2240 wrote to memory of 1948	2240	regsvr32.exe	28
PID 1948 wrote to memory of 2136	1948	regsvr32.exe	29
PID 1948 wrote to memory of 2136	1948	regsvr32.exe	29
PID 1948 wrote to memory of 2136	1948	regsvr32.exe	29
PID 1948 wrote to memory of 2136	1948	regsvr32.exe	29

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\37966aa26ddabc9a2ad9c3043ec07b0b_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2240
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\37966aa26ddabc9a2ad9c3043ec07b0b_JaffaCakes118.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1948
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1948 -s 304
    3⤵
    - Program crash
    PID:2136