af7495ef2a261b0cfdbf30c27344e537728381b4bdf2e8d8ff741fea78c6563d

Analysis

max time kernel
144s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
18/04/2024, 01:45

Target

f705f66dd1734fef5c3f2a41c7c7254a_JaffaCakes118.dll
Size

70KB
MD5

f705f66dd1734fef5c3f2a41c7c7254a
SHA1

bd03e4008be05c0a0a6edd06ed534fb5144b7f7e
SHA256

af7495ef2a261b0cfdbf30c27344e537728381b4bdf2e8d8ff741fea78c6563d
SHA512

ba5b63ab7f56040a78b3c22c6df10c96a43e82ae330ba5e7590675fa58a9b0df8c6782ffb32355226b01e596f60449f9ea512e5bdb0704f7ca540154f5101061
SSDEEP

1536:JFCWgv5KyLbq8/OUfmGU/MrwU+tpgRh6Tj2KQ7Y:J0JhKuPeGUa+tpcoj2FM

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2512 wrote to memory of 1284	2512	regsvr32.exe	91
PID 2512 wrote to memory of 1284	2512	regsvr32.exe	91
PID 2512 wrote to memory of 1284	2512	regsvr32.exe	91

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\f705f66dd1734fef5c3f2a41c7c7254a_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2512
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\f705f66dd1734fef5c3f2a41c7c7254a_JaffaCakes118.dll
  2⤵
  PID:1284

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1400 --field-trial-handle=2256,i,6670388345726423024,18382795228658886258,262144 --variations-seed-version /prefetch:8
1⤵
PID:1864

memory/1284-0-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download