ae2d4e30fc3662f519ae2925344287801f0ff78d1d92e9ca29e47daf61e37776

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
19/07/2024, 06:50

Target

5ae0291b2017e15e916eff0f7e0eeafc_JaffaCakes118.dll
Size

101KB
MD5

5ae0291b2017e15e916eff0f7e0eeafc
SHA1

e41ae1d739988422c6f7e01209a7cb9164a8c62b
SHA256

ae2d4e30fc3662f519ae2925344287801f0ff78d1d92e9ca29e47daf61e37776
SHA512

7205c0cb47dd158985f613ef67fa20d332d9d45236569e8b7666bf9617456ac25477905e7acbf13bc73b4f5db2ca89853a689470a8137bd6e93b5cd52216840b
SSDEEP

1536:HD2WgET4Ab/oO6Zk1Hs4MyqiMRl+RoZax3/FYYK7/+5U/DKQnAVUE6aVaA4kskmQ:jlcAb/6CM4IhqHQ/K2AxRf3rX

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4952	4524	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4108 wrote to memory of 4524	4108	regsvr32.exe	83
PID 4108 wrote to memory of 4524	4108	regsvr32.exe	83
PID 4108 wrote to memory of 4524	4108	regsvr32.exe	83

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\5ae0291b2017e15e916eff0f7e0eeafc_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4108
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\5ae0291b2017e15e916eff0f7e0eeafc_JaffaCakes118.dll
  2⤵
  PID:4524
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4524 -s 616
    3⤵
    - Program crash
    PID:4952

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4524 -ip 4524
1⤵
PID:208

memory/4524-0-0x0000000000550000-0x0000000000597000-memory.dmp

Filesize
284KB

Download