f3db0e3cad037bb885b06c17aaf76977d6e91858032e2fb5d5b759421cea4692

Analysis

max time kernel
140s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
23/07/2024, 07:11

Target

669c9ffb80dda9e055f8060332ca9c75_JaffaCakes118.dll
Size

87KB
MD5

669c9ffb80dda9e055f8060332ca9c75
SHA1

3af34d9cc43083ca00ebbbd7f8cbc94bb6276ca0
SHA256

f3db0e3cad037bb885b06c17aaf76977d6e91858032e2fb5d5b759421cea4692
SHA512

668fc430d7f57848e55c2b1acafd29140431d72353209b832208f2eb9f6088fb4c699ce6f990a9e45a6717e4b30f24e2307a962177293a4d52788c0957c46f6c
SSDEEP

1536:leSHmch8Hh7o4voO9y0NaybOCOFUsz4rbaZo5lXoUn/Bn8xg5iWqUSKPPFJ9ZV5s:LLhStwOnTbODmszUbt//B8xd9279ZjfE

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4264	4960	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4804 wrote to memory of 4960	4804	regsvr32.exe	84
PID 4804 wrote to memory of 4960	4804	regsvr32.exe	84
PID 4804 wrote to memory of 4960	4804	regsvr32.exe	84

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\669c9ffb80dda9e055f8060332ca9c75_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4804
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\669c9ffb80dda9e055f8060332ca9c75_JaffaCakes118.dll
  2⤵
  PID:4960
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4960 -s 596
    3⤵
    - Program crash
    PID:4264

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4960 -ip 4960
1⤵
PID:3808

memory/4960-0-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download