94699176482565587dc4ae98c347a7ea0a886987ca978932a296b235a23c0f9a

Analysis

max time kernel
94s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
15/07/2024, 05:46

Target

48791b2196dd7784e8b5b59da128689a_JaffaCakes118.dll
Size

158KB
MD5

48791b2196dd7784e8b5b59da128689a
SHA1

0dacb99be7fea24dbeeb03fe6715f82fd38eec74
SHA256

94699176482565587dc4ae98c347a7ea0a886987ca978932a296b235a23c0f9a
SHA512

5ad8809c27fd5e25e538fd71e96682ba6280a4d8ba28dffc4f4a182bb4a27a6a7c50d3c21ef2cf8ab766b6b4401fd9d9e8d3f1ed4fa1f0e3917d37eda34c4973
SSDEEP

3072:wQ0ukp3TyE2M0Tu9HDH0617/J3DN6OoN5QwCGTu9:BIpjRToGL0617T6H599G

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4340	4228	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2576 wrote to memory of 4228	2576	regsvr32.exe	84
PID 2576 wrote to memory of 4228	2576	regsvr32.exe	84
PID 2576 wrote to memory of 4228	2576	regsvr32.exe	84

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\48791b2196dd7784e8b5b59da128689a_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2576
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\48791b2196dd7784e8b5b59da128689a_JaffaCakes118.dll
  2⤵
  PID:4228
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4228 -s 580
    3⤵
    - Program crash
    PID:4340

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4228 -ip 4228
1⤵
PID:2460

memory/4228-0-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download