cacfa372b0dc942297e06d12e7a9ff40660e25e34973b21c6a081e9245d54980

Analysis

max time kernel
51s
max time network
51s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
20-06-2024 16:20

Target

07af30cee51123b544f32039a47861f7_JaffaCakes118.dll
Size

47KB
MD5

07af30cee51123b544f32039a47861f7
SHA1

282770d5426195e363c91e25dbbebf6d7eab0b2c
SHA256

cacfa372b0dc942297e06d12e7a9ff40660e25e34973b21c6a081e9245d54980
SHA512

c99cda70b089c630448506c9d8da5fe15d70c129c16e3e8dca3c2136a6ddd5924aac5a23bb8fd4cf27a9af3830642753ca12eae9b14ed16c8ea2b83629124681
SSDEEP

768:wSVMqQCVaQkUwjWnolH01tZjiO5OpBlkSblLfqRRWvGfFeiatCV3xOHAQFAr:nVMqFVaQbOH0jZjiGOpBlkSbl+awgCXt

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1644 wrote to memory of 2144	1644	regsvr32.exe	82
PID 1644 wrote to memory of 2144	1644	regsvr32.exe	82
PID 1644 wrote to memory of 2144	1644	regsvr32.exe	82

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\07af30cee51123b544f32039a47861f7_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1644
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\07af30cee51123b544f32039a47861f7_JaffaCakes118.dll
  2⤵
  PID:2144

memory/2144-0-0x0000000000630000-0x0000000000641000-memory.dmp

Filesize
68KB

Download