2e505c4baa8b29009c562dd01543740be0788872a1d80be80e49b10577bd05ec

Analysis

max time kernel
93s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
21-07-2024 12:40

Target

6098ff000b2a54516e9c61fe98b0cf90_JaffaCakes118.dll
Size

256KB
MD5

6098ff000b2a54516e9c61fe98b0cf90
SHA1

fbdcbb500eb77dc89183fad243c658c7a608dd7f
SHA256

2e505c4baa8b29009c562dd01543740be0788872a1d80be80e49b10577bd05ec
SHA512

5ef244cd26b8a3ce9a76ee22d03e3a4fdb4885e6a353c9aff86c002f45c4057c59e56b334339febdc6cf3a77a7c6d593365c74cd3f7e19a81e4af6a9d4f0ccd8
SSDEEP

3072:Dvji2kRPhQskqgo3tD5/PWd7yto2NR55JcgnXPEnGwR+Zvzon1P6m:DnkVhV1NRPWwvNUz

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1664	4732	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1476 wrote to memory of 4732	1476	regsvr32.exe	84
PID 1476 wrote to memory of 4732	1476	regsvr32.exe	84
PID 1476 wrote to memory of 4732	1476	regsvr32.exe	84

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\6098ff000b2a54516e9c61fe98b0cf90_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1476
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\6098ff000b2a54516e9c61fe98b0cf90_JaffaCakes118.dll
  2⤵
  PID:4732
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4732 -s 624
    3⤵
    - Program crash
    PID:1664

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 4732 -ip 4732
1⤵
PID:952

memory/4732-0-0x0000000010000000-0x0000000010040000-memory.dmp

Filesize
256KB

Download