2f1118d2702d0e3c12ce25fdbf2925aafc7d1681fa5b5ee3bb40d10230301890

Analysis

max time kernel
13s
max time network
20s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
16/07/2024, 10:27

Target

4de94fa67e62e75113c77cc790dfe680_JaffaCakes118.dll
Size

145KB
MD5

4de94fa67e62e75113c77cc790dfe680
SHA1

dfb74ad99965ba2eb59d1f08b6333aa13859ab20
SHA256

2f1118d2702d0e3c12ce25fdbf2925aafc7d1681fa5b5ee3bb40d10230301890
SHA512

9d84eca19ce8e83fc6a75b587ebabfcf812c4123399d66d381048b77434a3684ad90605d4ca46e45285cc529d050f5c3c7a3a4ca525a13c1eec874cad7e7cab1
SSDEEP

3072:sQzoKqIR5zY4B+IJywjoL5CmKmitGBrAwPdO2:sQzoCRMIJPqCyv9dO2

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2980	2464	WerFault.exe	30

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2776 wrote to memory of 2464	2776	regsvr32.exe	30
PID 2776 wrote to memory of 2464	2776	regsvr32.exe	30
PID 2776 wrote to memory of 2464	2776	regsvr32.exe	30
PID 2776 wrote to memory of 2464	2776	regsvr32.exe	30
PID 2776 wrote to memory of 2464	2776	regsvr32.exe	30
PID 2776 wrote to memory of 2464	2776	regsvr32.exe	30
PID 2776 wrote to memory of 2464	2776	regsvr32.exe	30
PID 2464 wrote to memory of 2980	2464	regsvr32.exe	31
PID 2464 wrote to memory of 2980	2464	regsvr32.exe	31
PID 2464 wrote to memory of 2980	2464	regsvr32.exe	31
PID 2464 wrote to memory of 2980	2464	regsvr32.exe	31

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\4de94fa67e62e75113c77cc790dfe680_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2776
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\4de94fa67e62e75113c77cc790dfe680_JaffaCakes118.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2464
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2464 -s 304
    3⤵
    - Program crash
    PID:2980