15a9c386521b7ea063f0bde08c4c8e310f4d9a0565f6bd791cf2c18025d8aa6b

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
22/07/2024, 14:20

Target

6383bd63ddb87d5dcb86f9675a625b22_JaffaCakes118.dll
Size

167KB
MD5

6383bd63ddb87d5dcb86f9675a625b22
SHA1

730bffe176fa5d1175f218971534110487d4a98c
SHA256

15a9c386521b7ea063f0bde08c4c8e310f4d9a0565f6bd791cf2c18025d8aa6b
SHA512

38c3daf9721c7fa2967af0d1eb781951701a6883d484d5ac2ab6d1367593980c0a4f9572b3c18265a659bc80f74fb0173de0e17b03fa321134ad39070da62a75
SSDEEP

1536:td8CHyODFIjHIN7zQmuFXAdmmdyunZxYN3DrtY1B4xx3k98b0DuLco:rLHy067IN7zQmuB7Punoqbj9RDuLj

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1036	4484	WerFault.exe	86

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1876 wrote to memory of 4484	1876	regsvr32.exe	86
PID 1876 wrote to memory of 4484	1876	regsvr32.exe	86
PID 1876 wrote to memory of 4484	1876	regsvr32.exe	86

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\6383bd63ddb87d5dcb86f9675a625b22_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1876
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\6383bd63ddb87d5dcb86f9675a625b22_JaffaCakes118.dll
  2⤵
  PID:4484
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4484 -s 600
    3⤵
    - Program crash
    PID:1036

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4484 -ip 4484
1⤵
PID:2444

memory/4484-0-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/4484-1-0x0000000000445000-0x0000000000446000-memory.dmp

Filesize
4KB

Download