90e0ab369a18598fec297d5c89e55165d2cec48d1aa16facd8beb3c62ac7006b

Analysis

max time kernel
138s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
20/07/2024, 07:49

Target

5fa1dea5ac6b0c4071629f7efdf5748a_JaffaCakes118.dll
Size

88KB
MD5

5fa1dea5ac6b0c4071629f7efdf5748a
SHA1

225787e5821301fb3f33f83af0e64e8362d164ce
SHA256

90e0ab369a18598fec297d5c89e55165d2cec48d1aa16facd8beb3c62ac7006b
SHA512

f36e4925fa63e2813b859ec549c543c321f2ec50ae7a155217ba2cf037e74b9abc5dbb6a561672a1a24dad332f0a3364ce117c03e6039552ba3eb1e412c40377
SSDEEP

1536:y9+8yxz2xm8Do9oJe9/QTxJHWy9zLSM9bTmtZ+zgdvfomF8dBVT/IxJVcsxJS:ygxz6To9Ue9oTr1ZLSMJTmtXVQtdBl/X

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4312	2632	WerFault.exe	86

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1860 wrote to memory of 2632	1860	regsvr32.exe	86
PID 1860 wrote to memory of 2632	1860	regsvr32.exe	86
PID 1860 wrote to memory of 2632	1860	regsvr32.exe	86

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\5fa1dea5ac6b0c4071629f7efdf5748a_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1860
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\5fa1dea5ac6b0c4071629f7efdf5748a_JaffaCakes118.dll
  2⤵
  PID:2632
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2632 -s 596
    3⤵
    - Program crash
    PID:4312

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 2632 -ip 2632
1⤵
PID:1080

memory/2632-0-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download