fdc68cf8b91fc0354cce956a4b14926db370b387d01db6b3602610c0c21e2878

Analysis

max time kernel
51s
max time network
54s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
20-06-2024 01:51

Target

01d1c1501f104376973fe25263edf899_JaffaCakes118.dll
Size

117KB
MD5

01d1c1501f104376973fe25263edf899
SHA1

74e2b04633672a1204bd06f6c36ae259fbfca683
SHA256

fdc68cf8b91fc0354cce956a4b14926db370b387d01db6b3602610c0c21e2878
SHA512

bc138cb29d786e1b8d85deab1c828ee67e52c486a7f71f392f7dd5ac9ec711f74404bb5ad914bbec984826d1399c248779e5178e1ee4833fd488dbfea1bf5942
SSDEEP

3072:Jiziq9CFTja+dWBK3UB2uw9Z9waGfqrJnC1c/xKwGcqO9K4:gzFCRldWBKew9Zma4iQcEnO9K

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1760 wrote to memory of 5000	1760	regsvr32.exe	82
PID 1760 wrote to memory of 5000	1760	regsvr32.exe	82
PID 1760 wrote to memory of 5000	1760	regsvr32.exe	82

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\01d1c1501f104376973fe25263edf899_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1760
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\01d1c1501f104376973fe25263edf899_JaffaCakes118.dll
  2⤵
  PID:5000

memory/5000-0-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/5000-2-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/5000-1-0x0000000000449000-0x000000000044A000-memory.dmp

Filesize
4KB

Download