4ec645da730f1bcae05a9ff42fc06df463eb625dae01587c1f84e8890bfc3b07

Analysis

max time kernel
94s
max time network
133s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
16/07/2024, 06:29

Target

4d2ab15135a59694a1cc46ada5020fb1_JaffaCakes118.dll
Size

91KB
MD5

4d2ab15135a59694a1cc46ada5020fb1
SHA1

fe706d003bf1a8a5667d5c59dbc4fb535cde18b6
SHA256

4ec645da730f1bcae05a9ff42fc06df463eb625dae01587c1f84e8890bfc3b07
SHA512

faa8b2a7cedbffe038aab5d337e083446ccb7f27f7e55c40fe79b9e78096af14ff2b0d08c6f33764e0a9ac2149ddb631be9032b096d5fdf1c900b95c4051bca1
SSDEEP

1536:V2/7gCuQ//Mh/zW3iQdJL3ZMe5fpiMJa7k9ieW8KBqIkn4NeoRUflWlDHAU53iQc:V2zGQ/EhLUiQPtfpRaMW8JIU4UoOW9gT

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3940	2424	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3548 wrote to memory of 2424	3548	regsvr32.exe	83
PID 3548 wrote to memory of 2424	3548	regsvr32.exe	83
PID 3548 wrote to memory of 2424	3548	regsvr32.exe	83

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\4d2ab15135a59694a1cc46ada5020fb1_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3548
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\4d2ab15135a59694a1cc46ada5020fb1_JaffaCakes118.dll
  2⤵
  PID:2424
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2424 -s 604
    3⤵
    - Program crash
    PID:3940

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 2424 -ip 2424
1⤵
PID:1356

memory/2424-0-0x0000000000D30000-0x0000000000D76000-memory.dmp

Filesize
280KB

Download
memory/2424-1-0x0000000000D30000-0x0000000000D76000-memory.dmp

Filesize
280KB

Download