58fb2d971a99379c3583a98ea9659b21bacb50facda6234559d9020c4c582f3c

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
18-04-2024 05:27

Target

f75b73e18a20f77a585e941e2d2f0629_JaffaCakes118.dll
Size

239KB
MD5

f75b73e18a20f77a585e941e2d2f0629
SHA1

31a344f3aaeadfaaac3885ee42afc1a5368fc591
SHA256

58fb2d971a99379c3583a98ea9659b21bacb50facda6234559d9020c4c582f3c
SHA512

72b029c3be18d73e875b06f80abc330d33e20b1f32996e16fa75aefdfcbf9d405a549126128484e8ef707981ec8508921ef3636f6c503ad7a27507e517f40db0
SSDEEP

3072:B5N4odXr2vrb8JEb8JEb8JEb8JEb8JEb8JEb8JEb8JEb8JEb8Je:B5NDlruHzzzzzzzzzn

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3672 wrote to memory of 3604	3672	regsvr32.exe	90
PID 3672 wrote to memory of 3604	3672	regsvr32.exe	90
PID 3672 wrote to memory of 3604	3672	regsvr32.exe	90

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\f75b73e18a20f77a585e941e2d2f0629_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3672
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\f75b73e18a20f77a585e941e2d2f0629_JaffaCakes118.dll
  2⤵
  PID:3604

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4052 --field-trial-handle=2304,i,6987730730348465820,3913273227385401271,262144 --variations-seed-version /prefetch:8
1⤵
PID:3472

memory/3604-0-0x0000000000010000-0x000000000002A000-memory.dmp

Filesize
104KB

Download