093775877e26e3e21ead7afa5ca3817eff3665ec0235be722c502809e30df794

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
20-07-2024 08:38

Target

5fc8b454a5a0494c675a7a808adf1a94_JaffaCakes118.exe
Size

328KB
MD5

5fc8b454a5a0494c675a7a808adf1a94
SHA1

c8903dbfce71b26512f58280560f2d04d52dab9a
SHA256

093775877e26e3e21ead7afa5ca3817eff3665ec0235be722c502809e30df794
SHA512

522049b5bcbbd4bd0ee995c9953b21e3203f11cbec4ab3115e5cc14ba9ed5bad1b1b502ffc93381fffadbd0e78d8e819a1ba8d359ed6627af833fe18f762da27
SSDEEP

6144:clFb8fBJOeG7yoImS67B7zHCvc9q1bUFIfRI4pdvFD:clZsBJKGoImj75zHCYqNTfzFFD

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2872	2804	WerFault.exe	30

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2808 wrote to memory of 2804	2808	regsvr32.exe	30
PID 2808 wrote to memory of 2804	2808	regsvr32.exe	30
PID 2808 wrote to memory of 2804	2808	regsvr32.exe	30
PID 2808 wrote to memory of 2804	2808	regsvr32.exe	30
PID 2808 wrote to memory of 2804	2808	regsvr32.exe	30
PID 2808 wrote to memory of 2804	2808	regsvr32.exe	30
PID 2808 wrote to memory of 2804	2808	regsvr32.exe	30
PID 2804 wrote to memory of 2872	2804	regsvr32.exe	31
PID 2804 wrote to memory of 2872	2804	regsvr32.exe	31
PID 2804 wrote to memory of 2872	2804	regsvr32.exe	31
PID 2804 wrote to memory of 2872	2804	regsvr32.exe	31

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\5fc8b454a5a0494c675a7a808adf1a94_JaffaCakes118.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:2808
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\5fc8b454a5a0494c675a7a808adf1a94_JaffaCakes118.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2804
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2804 -s 292
    3⤵
    - Program crash
    PID:2872