34bbbba8e0e469bafd1a1851b885084dfbf2e4ea96558a370d2d60daa537ec34

Analysis

max time kernel
94s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
15/07/2024, 08:25

Target

48fc84c72a179d5716bf690636b5cf1d_JaffaCakes118.dll
Size

208KB
MD5

48fc84c72a179d5716bf690636b5cf1d
SHA1

b8d4d99833eb393e896d961294adfffe17636e47
SHA256

34bbbba8e0e469bafd1a1851b885084dfbf2e4ea96558a370d2d60daa537ec34
SHA512

0a77ad7600ff8bb4406f1f3441b97917f0e7898bdd0179d586ec888b3285ac1a60dd66b423c25c5ed6754019e243e49378340fce5d0f4dcc394917209ca49603
SSDEEP

1536:eHJLDtgABkVkcvxOIe6+UP8CW5PfIMOIbpbw2mNWuYw+NaD7BaX3sH0Uqy9Wt0t3:epibycv8nIMOIbpbo7gE0Xy9E0Ypi

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1244	4612	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1412 wrote to memory of 4612	1412	regsvr32.exe	83
PID 1412 wrote to memory of 4612	1412	regsvr32.exe	83
PID 1412 wrote to memory of 4612	1412	regsvr32.exe	83

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\48fc84c72a179d5716bf690636b5cf1d_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1412
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\48fc84c72a179d5716bf690636b5cf1d_JaffaCakes118.dll
  2⤵
  PID:4612
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4612 -s 600
    3⤵
    - Program crash
    PID:1244

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 4612 -ip 4612
1⤵
PID:3764

memory/4612-0-0x000000005EDF1000-0x000000005EDFE000-memory.dmp

Filesize
52KB

Download