0bcef071fcb53dd20ff8966effaf8cb3d9806b4d26015a03bd123e59d95d9e5b

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
20/06/2024, 03:06

Target

0248d702f1af8c434c817f6eb0903020_JaffaCakes118.dll
Size

47KB
MD5

0248d702f1af8c434c817f6eb0903020
SHA1

e484fe93b4da71678bdfba33a0eb14977bba7fd6
SHA256

0bcef071fcb53dd20ff8966effaf8cb3d9806b4d26015a03bd123e59d95d9e5b
SHA512

cf5d37f10bbb11da7e2f69f4ef20b15ec4be41bd9e861beb9040261571d58e1bc702cd0a1b6ec8f04ebaa7ee855040c241604189621ca155028156cf4f6919ad
SSDEEP

768:USVMqQCVaQkUwjWnomXxdmdRiO5OpBl2MLgaH4Gf1CYvCO6xOHeQEYttH8:zVMqFVaQbdXkiGOpBl25YaXXQEYtp8

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1220 wrote to memory of 1732	1220	regsvr32.exe	84
PID 1220 wrote to memory of 1732	1220	regsvr32.exe	84
PID 1220 wrote to memory of 1732	1220	regsvr32.exe	84

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\0248d702f1af8c434c817f6eb0903020_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1220
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\0248d702f1af8c434c817f6eb0903020_JaffaCakes118.dll
  2⤵
  PID:1732

memory/1732-0-0x00000000007B0000-0x00000000007C1000-memory.dmp

Filesize
68KB

Download