4eed059510fe9e1b3a457114c121eb8a29909d1fe8a483ff5f69f94a344b5fd4

Analysis

max time kernel
141s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
20/04/2024, 07:09

Target

fc345e84f5b7b01cb89705f63375465f_JaffaCakes118.dll
Size

183KB
MD5

fc345e84f5b7b01cb89705f63375465f
SHA1

b6f28cef47d5f922deb27248aa90725fe78ae417
SHA256

4eed059510fe9e1b3a457114c121eb8a29909d1fe8a483ff5f69f94a344b5fd4
SHA512

8488bcc4ed6bf4bfa8860499ffdc70d04c4fa5bfb0b58bf2c8c73d024b9793d93db446e1bb3cca5e72b5435c2fdc4275faa48950d01d564ce3bb7dba9cbc9f9c
SSDEEP

3072:18+5OUEfsFKVsFKVsFKVsFKVsFKVsFKVsFKVsFKVsFKVsFKi:18+OzfrVrVrVrVrVrVrVrVrVri

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4396 wrote to memory of 1604	4396	regsvr32.exe	88
PID 4396 wrote to memory of 1604	4396	regsvr32.exe	88
PID 4396 wrote to memory of 1604	4396	regsvr32.exe	88

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\fc345e84f5b7b01cb89705f63375465f_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4396
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\fc345e84f5b7b01cb89705f63375465f_JaffaCakes118.dll
  2⤵
  PID:1604

memory/1604-0-0x0000000000010000-0x0000000000025000-memory.dmp

Filesize
84KB

Download