ca86450ec13f1d39942db4f5a01ee9cd225aabc2a666e479b5a8628074d4af4f

Analysis

max time kernel
148s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
16/04/2024, 17:00

Target

f3eb90431aa8a109d0219d8072d7c23b_JaffaCakes118.dll
Size

120KB
MD5

f3eb90431aa8a109d0219d8072d7c23b
SHA1

fb97477f9c989ff3ce7033e2b6e8bd6f81f8f00d
SHA256

ca86450ec13f1d39942db4f5a01ee9cd225aabc2a666e479b5a8628074d4af4f
SHA512

a188705ce622e0fb4b984cb2e499c617832e2167072a862de738fb3a59cc5bc388502984a97dd5e35228a115f6582e08d9e8dbbf510600eccc44b70c2277c1e4
SSDEEP

1536:trVq1QLko9egQKFesV4uHIVENTAs3Qcn/VPJgoJn8:2YkolQKFalENTXAcn/VPJgL

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1968 wrote to memory of 2028	1968	regsvr32.exe	82
PID 1968 wrote to memory of 2028	1968	regsvr32.exe	82
PID 1968 wrote to memory of 2028	1968	regsvr32.exe	82

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\f3eb90431aa8a109d0219d8072d7c23b_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1968
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\f3eb90431aa8a109d0219d8072d7c23b_JaffaCakes118.dll
  2⤵
  PID:2028

memory/2028-0-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download