52f36620bf42b31c349e9c20f08c70f207dfda92d84b18df6507df6f2ffd707a

Analysis

max time kernel
93s
max time network
118s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
11-04-2024 09:13

Target

ed123a3cb173f113bb98177f1d17f23e_JaffaCakes118.dll
Size

40KB
MD5

ed123a3cb173f113bb98177f1d17f23e
SHA1

5c7184b7759d0b4a0f025af26c540dabb120959e
SHA256

52f36620bf42b31c349e9c20f08c70f207dfda92d84b18df6507df6f2ffd707a
SHA512

fd6cbc50d3f12736cf548929160b5acddd3f2e6a808b6e7e1c81696ba3550e8915dc4ccf229576b3842d250d39841a0a02d8517ee70c0bbb94c8fdae1b2313ac
SSDEEP

768:Q/Q5HuzZ53DlZa6bpkavzeRbV5JpgLa16AC:QoNwZplq5J2La3

Score

1^/10

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5020	Rundll32.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5020	Rundll32.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1832 wrote to memory of 4696	1832	regsvr32.exe	85
PID 1832 wrote to memory of 4696	1832	regsvr32.exe	85
PID 1832 wrote to memory of 4696	1832	regsvr32.exe	85
PID 4696 wrote to memory of 5020	4696	regsvr32.exe	86
PID 4696 wrote to memory of 5020	4696	regsvr32.exe	86
PID 4696 wrote to memory of 5020	4696	regsvr32.exe	86

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\ed123a3cb173f113bb98177f1d17f23e_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1832
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\ed123a3cb173f113bb98177f1d17f23e_JaffaCakes118.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4696
- - C:\Windows\SysWOW64\Rundll32.exe
    C:\Windows\system32\Rundll32.exe C:\Users\Admin\AppData\Local\Temp\ed123a3cb173f113bb98177f1d17f23e_JaffaCakes118.dll,DllUnregisterServer
    3⤵
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    PID:5020