08e572a87c7813efbef25e9f9a324eab9b81c1df2eae68c7140ddfe55cd88e53

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
23/07/2024, 13:37

Target

67ca12aded9c52cb0b082115a56cacb7_JaffaCakes118.dll
Size

628KB
MD5

67ca12aded9c52cb0b082115a56cacb7
SHA1

227bc17efa54edada9f4d102c18b6383c2145d9d
SHA256

08e572a87c7813efbef25e9f9a324eab9b81c1df2eae68c7140ddfe55cd88e53
SHA512

9c24b1ec8c4fab0233042cbc0402b85e34a321e332611497c1bf7f12f26ae7bfbd361137e091ff86b51ca548ff0262094f62a71044e964c2cc6554e92ead52a2
SSDEEP

12288:aXN+j2hor0tDRNtIuH0of9WTUKsbqbGkMME23:aXXhc0t17IuH0ofSUKsbIM323

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4832	3852	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3824 wrote to memory of 3852	3824	regsvr32.exe	84
PID 3824 wrote to memory of 3852	3824	regsvr32.exe	84
PID 3824 wrote to memory of 3852	3824	regsvr32.exe	84

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\67ca12aded9c52cb0b082115a56cacb7_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3824
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\67ca12aded9c52cb0b082115a56cacb7_JaffaCakes118.dll
  2⤵
  PID:3852
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3852 -s 740
    3⤵
    - Program crash
    PID:4832

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 3852 -ip 3852
1⤵
PID:1244

memory/3852-0-0x0000000074B70000-0x0000000074C0F000-memory.dmp

Filesize
636KB

Download