f5aa0b790aa27dea53ee0b52d5e0021203fab7fcbc7fb4dfe4a8f5e3ae0e51bd

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
14/07/2024, 16:27

Target

469ba8846fef1133140ecb3619963ef2_JaffaCakes118.dll
Size

82KB
MD5

469ba8846fef1133140ecb3619963ef2
SHA1

2beb1361ce44f083c237a73fb9a7361b822a0e0a
SHA256

f5aa0b790aa27dea53ee0b52d5e0021203fab7fcbc7fb4dfe4a8f5e3ae0e51bd
SHA512

ee9f6ac33eb46c92a1af68238b374df281bf9fd3781fc2e8f96e381b3dff3618a1e8d31c0916e5bb1f73fae15323515df29fd2cd8b3147381508c6e1e8713aaa
SSDEEP

1536:VU3CncWng22SFLIRQa8QRPF0h8k79Pl5E0HW6pOYST6V5Fq3o5pGVSyRl:VcGRJF8OgRPFidkFT4G3oOSyL

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2420	1692	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3036 wrote to memory of 1692	3036	regsvr32.exe	83
PID 3036 wrote to memory of 1692	3036	regsvr32.exe	83
PID 3036 wrote to memory of 1692	3036	regsvr32.exe	83

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\469ba8846fef1133140ecb3619963ef2_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3036
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\469ba8846fef1133140ecb3619963ef2_JaffaCakes118.dll
  2⤵
  PID:1692
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1692 -s 612
    3⤵
    - Program crash
    PID:2420

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 1692 -ip 1692
1⤵
PID:4004

memory/1692-0-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download