cb417f25006c0c05a8d272d6a3f358a853459b4c00cdd346bcc749c9a7126e9a

Analysis

max time kernel
51s
max time network
57s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
19/06/2024, 19:04

Target

0015068d9af7ef9da00d38f908362533_JaffaCakes118.dll
Size

19KB
MD5

0015068d9af7ef9da00d38f908362533
SHA1

3f444824870ed61a3c3f707d22fd7521f9eceb92
SHA256

cb417f25006c0c05a8d272d6a3f358a853459b4c00cdd346bcc749c9a7126e9a
SHA512

568551ed16daa975e29702fe8e1884f7741645abefeb360631af7fed53ce081843c0258ba51c4a214b79d8cbdd306a68e98420b0440cfe0c90f73f4fccebf2ae
SSDEEP

384:eWWTEcWePKORLzOIB5X5mFh0V4wKOZk+SaJgD/JSu116:VaKORLzOIBF5yCq8ZkTaqDS

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2440 wrote to memory of 3248	2440	regsvr32.exe	81
PID 2440 wrote to memory of 3248	2440	regsvr32.exe	81
PID 2440 wrote to memory of 3248	2440	regsvr32.exe	81

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\0015068d9af7ef9da00d38f908362533_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2440
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\0015068d9af7ef9da00d38f908362533_JaffaCakes118.dll
  2⤵
  PID:3248

memory/3248-0-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download