d395e54189c789d811de1941e8bf75d36e0ffb7d0ff1e0aa5c30f47cadcb5927

Analysis

max time kernel
95s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
13/07/2024, 17:15

Target

429c5066f8b239caa2ea68edc2c12e0d_JaffaCakes118.dll
Size

68KB
MD5

429c5066f8b239caa2ea68edc2c12e0d
SHA1

0738a1bc16d7594cd5d1792f331dfb7ea0c0fc0e
SHA256

d395e54189c789d811de1941e8bf75d36e0ffb7d0ff1e0aa5c30f47cadcb5927
SHA512

75462bd945cf694d1d5731a43992bf5ddd03487170aca854399432f8d914a8b39b22b6a4e95fa5013e29e6de5aba626944f43fe2f44be358d8f01385ead4507c
SSDEEP

1536:4tMqaObQ7piNWIcbiHCj/d0NvHjWh2BNbzJp2AVgDraZ:k9LOXwvHjWh2BNp0TmZ

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2612	1536	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4584 wrote to memory of 1536	4584	regsvr32.exe	83
PID 4584 wrote to memory of 1536	4584	regsvr32.exe	83
PID 4584 wrote to memory of 1536	4584	regsvr32.exe	83

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\429c5066f8b239caa2ea68edc2c12e0d_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4584
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\429c5066f8b239caa2ea68edc2c12e0d_JaffaCakes118.dll
  2⤵
  PID:1536
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1536 -s 660
    3⤵
    - Program crash
    PID:2612

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 1536 -ip 1536
1⤵
PID:2768

memory/1536-0-0x0000000000710000-0x0000000000727000-memory.dmp

Filesize
92KB

Download