810541afa7f0b98d61e978a2e830ae3a93c15dfc51af397801b1c7ec3be6b37b

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
11-07-2024 03:46

Target

37966aa26ddabc9a2ad9c3043ec07b0b_JaffaCakes118.dll
Size

156KB
MD5

37966aa26ddabc9a2ad9c3043ec07b0b
SHA1

817fd20a1ca6ee2bd973409033e2fee2f81eac57
SHA256

810541afa7f0b98d61e978a2e830ae3a93c15dfc51af397801b1c7ec3be6b37b
SHA512

4a49bd0873135e6ae6a5c1aa2d81634f3accdc688d4c826212eda6ae638d5999189ce2bbacc6f5aef1ecc07c061707d85c8baa77779ed657aa093b0569f779d0
SSDEEP

3072:kuhE6zRkEC1C9n2T5JEW9ytOHsHYRf9gNR5hXRzJrvC:kuh1C1XXmYRFgNXtrvC

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3736	1236	WerFault.exe	84
2504	1236	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3144 wrote to memory of 1236	3144	regsvr32.exe	84
PID 3144 wrote to memory of 1236	3144	regsvr32.exe	84
PID 3144 wrote to memory of 1236	3144	regsvr32.exe	84

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\37966aa26ddabc9a2ad9c3043ec07b0b_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3144
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\37966aa26ddabc9a2ad9c3043ec07b0b_JaffaCakes118.dll
  2⤵
  PID:1236
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1236 -s 596
    3⤵
    - Program crash
    PID:3736
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1236 -s 632
    3⤵
    - Program crash
    PID:2504

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1236 -ip 1236
1⤵
PID:2948

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 1236 -ip 1236
1⤵
PID:1536