1894fd120b95fef68cae5613272e77dc4f10821c78105d354699b13b96a5fc4e

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
15/07/2024, 19:02

Target

4afe8a4aecfa1b7cf627657b5c57c6d9_JaffaCakes118.dll
Size

85KB
MD5

4afe8a4aecfa1b7cf627657b5c57c6d9
SHA1

588924dfd0bafe8247a42af7a658b4b35098773f
SHA256

1894fd120b95fef68cae5613272e77dc4f10821c78105d354699b13b96a5fc4e
SHA512

abbf2826889eb5345c69297eb1f1c8ccf13ee651230354d2db0a9e1ea4a737c8649dc4a0471c6d219375c164ce4a325cefa96b3468e4b75ec04daf71ec748d87
SSDEEP

1536:3oIivf2pM/0AL5PtzBt9922+Xsz4rbaZo5lXoUn/Bn8xg5iWqUrCjffSnGbz1i4V:3oIivQA5PtVfF+XszUbt//B8xd9g6fjL

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2988	2548	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4300 wrote to memory of 2548	4300	regsvr32.exe	83
PID 4300 wrote to memory of 2548	4300	regsvr32.exe	83
PID 4300 wrote to memory of 2548	4300	regsvr32.exe	83

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\4afe8a4aecfa1b7cf627657b5c57c6d9_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4300
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\4afe8a4aecfa1b7cf627657b5c57c6d9_JaffaCakes118.dll
  2⤵
  PID:2548
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2548 -s 596
    3⤵
    - Program crash
    PID:2988

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 2548 -ip 2548
1⤵
PID:2572

memory/2548-0-0x0000000000E30000-0x0000000000E73000-memory.dmp

Filesize
268KB

Download