bec13e536894d70d7314e7cc1f71336a4fcbd1412f82d2df5848c434fb3277dd

Analysis

max time kernel
147s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
10-04-2024 08:03

Target

ea9ce6867ce927586a33b41caffba7bd_JaffaCakes118.dll
Size

49KB
MD5

ea9ce6867ce927586a33b41caffba7bd
SHA1

390c2f7b49826051140bdc9a62b3f46a0185dca7
SHA256

bec13e536894d70d7314e7cc1f71336a4fcbd1412f82d2df5848c434fb3277dd
SHA512

8c7bff81212e3b8ea6d2a7051485077527b5c58a0102e6d4afcdb37f23c74c8745e373b49ebdc40b32acfb3736086ff22a644b2c459d6d0659959781bdfa8311
SSDEEP

768:FNGjXkm73tgpx3WmFMjyFDCVkqlUPpNLEP/Xb3AMvZmuPuinbcuyD7U:FojXkmapA5je0qpNY/XTA2m+uinouy8

Score

1^/10

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EE3612DC-2588-11DD-9B1D-A99356D89593}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EE3612DC-2588-11DD-9B1D-A99356D89593}\	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EE3612DC-2588-11DD-9B1D-A99356D89593}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EE3612DC-2588-11DD-9B1D-A99356D89593}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ea9ce6867ce927586a33b41caffba7bd_JaffaCakes118.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EE3612DC-2588-11DD-9B1D-A99356D89593}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1224 wrote to memory of 4368	1224	regsvr32.exe	85
PID 1224 wrote to memory of 4368	1224	regsvr32.exe	85
PID 1224 wrote to memory of 4368	1224	regsvr32.exe	85

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\ea9ce6867ce927586a33b41caffba7bd_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1224
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\ea9ce6867ce927586a33b41caffba7bd_JaffaCakes118.dll
  2⤵
  - Modifies registry class
  PID:4368

memory/4368-0-0x0000000000010000-0x0000000000038000-memory.dmp

Filesize
160KB

Download