93665c00584ba866c5cd881756213e38ff45c2a597f54a00891226846d3c7466

Analysis

max time kernel
120s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
04-07-2024 23:20

Target

269a89c3266cc20fcd136ff6a4db4d03_JaffaCakes118.dll
Size

192KB
MD5

269a89c3266cc20fcd136ff6a4db4d03
SHA1

e8a587e59be316431ae233b2307756c0e1302fc0
SHA256

93665c00584ba866c5cd881756213e38ff45c2a597f54a00891226846d3c7466
SHA512

4555fbbba06b6f27b1bfce293e5018e11ce2d743d978b29a0a8754c2fdc0840e1eec86f613d58d7f2dc0e2152cd30d4cb3f0e01ea71fce4d869d9586af1dd330
SSDEEP

3072:J0eolFsYEhUHmrv0dGrIQfheB96h4ZgTK+jDmJyksVqjOHJu9ramou9r0:J8lFshhUHSEChI966AGkAjOpoaDo0

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1944 4448 WerFault.exe regsvr32.exe

pid	pid_target	process	target process
1944	4448	WerFault.exe	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 3920 wrote to memory of 4448	3920	regsvr32.exe	regsvr32.exe
PID 3920 wrote to memory of 4448	3920	regsvr32.exe	regsvr32.exe
PID 3920 wrote to memory of 4448	3920	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\269a89c3266cc20fcd136ff6a4db4d03_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3920

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\269a89c3266cc20fcd136ff6a4db4d03_JaffaCakes118.dll
2⤵
PID:4448

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4448 -s 624
3⤵
- Program crash
PID:1944

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4448 -ip 4448
1⤵
PID:3328

memory/4448-0-0x0000000010000000-0x0000000010071000-memory.dmp

Filesize
452KB

Download