5287386b1bc883b851db2c0a91f42e2e8e6c5b167934fac6b58a88a2eff153a8

Analysis

max time kernel
129s
max time network
103s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
25/05/2024, 01:06

Target
70612be3a7aa63929575c2e5d552e761_JaffaCakes118.dll
Size 157KB
Sample240525-bf5ttahd33
SHA256 5287386b1bc883b851db2c0a91f42e2e8e6c5b167934fac6b58a88a2eff153a8
MD5 70612be3a7aa63929575c2e5d552e761
SHA1 08ae1a6317ff616429cf999ad668df7d5183b77b
SHA512 d77be6406f9e32abf4d682926f2dd594e850f32dc5aab6c07d878c560eecbbce277462208d5491bfd7d875cd28fad8c3b969ff15cafb5e6c51ced6a5adb9d626
SSDEEP 3072:BhrKBoVKsVl82PMfX7oqJHphZ6b9+gLQ8ul9hXDm1MqeMqml7:3uBoVKg82PIkqJJA/Lu43eMqm
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1292 wrote to memory of 1708	1292	regsvr32.exe	83
PID 1292 wrote to memory of 1708	1292	regsvr32.exe	83
PID 1292 wrote to memory of 1708	1292	regsvr32.exe	83

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\70612be3a7aa63929575c2e5d552e761_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1292
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\70612be3a7aa63929575c2e5d552e761_JaffaCakes118.dll
  2⤵
  PID:1708

memory/1708-1-0x000000001B5CE000-0x000000001B5CF000-memory.dmp

Download

memory/1708-0-0x000000001B570000-0x000000001B5D0000-memory.dmp

Download