a89fda9990eee55c96aa9e85a04105e983f2456b03624f32b9f254bd84bcf65d | Triage

Analysis

max time kernel
147s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
08/04/2024, 18:13

Sharing

Report Analysis Logs

General

Target

e819abc9ef47d4d372e118f010ce2343_JaffaCakes118.dll
Size

227KB
MD5

e819abc9ef47d4d372e118f010ce2343
SHA1

d30903f4487ff24ef78cf6179c1c3fe474e17965
SHA256

a89fda9990eee55c96aa9e85a04105e983f2456b03624f32b9f254bd84bcf65d
SHA512

72990f711652ef1ef64a38718ada30c318b89595444934e60c715fc96f2144bcc5dca47c3ac77e736cc90ace064538df4504ced7c16dad19398918dedf0ded2a
SSDEEP

6144:fW4TRMW4TRMW4TRMW4TRMW4TRMW4TRMW4TR:f000000

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3940 wrote to memory of 4036	3940	regsvr32.exe	84
PID 3940 wrote to memory of 4036	3940	regsvr32.exe	84
PID 3940 wrote to memory of 4036	3940	regsvr32.exe	84

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\e819abc9ef47d4d372e118f010ce2343_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3940
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\e819abc9ef47d4d372e118f010ce2343_JaffaCakes118.dll
  2⤵
  PID:4036

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads