a0ca27e8118c9122fd3a5abb5cb21eabedd79b473b04ddc8fd9764b07a49465f

Analysis

max time kernel
0s
max time network
37s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
10/06/2024, 14:06

Reason

Machine shutdown

Target
9aebff0dc01477e4c02b06d05d96a115_JaffaCakes118.dll
Size 352KB
Sample240610-res2maygpp
SHA256 a0ca27e8118c9122fd3a5abb5cb21eabedd79b473b04ddc8fd9764b07a49465f
MD5 9aebff0dc01477e4c02b06d05d96a115
SHA1 2dd13f35b165f9db02b552cb9b69aaf6c325ead2
SHA512 e14a3ee64b45fb9293624033d933f2cd15ef355f3a461300a349a63d6880ccfb2d9c7b84f3f61e0da2bd603b00e36ca640c91e1b0cf9f1d78ac9c7930e044be1
SSDEEP 6144:WZNJ0/OM471gBt3t5htjMGxz/oYBACHO7OpXME:cv0/Oyb99jDbH00v
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4516 wrote to memory of 2072	4516	regsvr32.exe	82
PID 4516 wrote to memory of 2072	4516	regsvr32.exe	82
PID 4516 wrote to memory of 2072	4516	regsvr32.exe	82

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\9aebff0dc01477e4c02b06d05d96a115_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4516
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\9aebff0dc01477e4c02b06d05d96a115_JaffaCakes118.dll
  2⤵
  PID:2072

memory/2072-0-0x0000000010000000-0x0000000010059000-memory.dmp

Download