4e6de9a3e475718677b09c97f1fa53dc52aef1a364dee8bf12e4034db2925b02

Analysis

max time kernel
143s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
15-07-2024 18:14

Target

4ad6433da0dce912b4d1300fbe34b0e0_JaffaCakes118.dll
Size

145KB
MD5

4ad6433da0dce912b4d1300fbe34b0e0
SHA1

39c665e53cf04c49881917c3cbe7e815030ec9d8
SHA256

4e6de9a3e475718677b09c97f1fa53dc52aef1a364dee8bf12e4034db2925b02
SHA512

6c33379b5e7d316624d31f0cf1203f765badc733609b4796b9f37faadd64992de34ecf0f1e34f6eb68f26a478d9cd9b61b7aa9ed58f059c3bfca424a1da54f63
SSDEEP

1536:pQd3BpWpLqsls1QIR5UWB+VRwenxIUYWcSAwjdOxHjHQNWoLyuh2eTLbQjOx+Z6K:pQzoKqIR5LBapvcSATboLyWVAS+t

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3080	4488	WerFault.exe	83
2236	4488	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4460 wrote to memory of 4488	4460	regsvr32.exe	83
PID 4460 wrote to memory of 4488	4460	regsvr32.exe	83
PID 4460 wrote to memory of 4488	4460	regsvr32.exe	83

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\4ad6433da0dce912b4d1300fbe34b0e0_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4460
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\4ad6433da0dce912b4d1300fbe34b0e0_JaffaCakes118.dll
  2⤵
  PID:4488
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4488 -s 580
    3⤵
    - Program crash
    PID:3080
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4488 -s 632
    3⤵
    - Program crash
    PID:2236

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 4488 -ip 4488
1⤵
PID:4248

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4488 -ip 4488
1⤵
PID:2196