275108502ef806957d6a93b35ddcefde0879807e73d958782e53626fecc6d441

Analysis

max time kernel
51s
max time network
51s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
20/06/2024, 17:29

Target

083ecbcd136ff8d393c91a121aefcdd3_JaffaCakes118.dll
Size

47KB
MD5

083ecbcd136ff8d393c91a121aefcdd3
SHA1

e090264d3aa34b7d4647512a7aaa8daa86ee2ed4
SHA256

275108502ef806957d6a93b35ddcefde0879807e73d958782e53626fecc6d441
SHA512

7d5778c1796e4bb71e0034b8cbbc999fed55261e4fa7f91797251a5a3c42655ca9c63829d49333c46da47d7637dc0d369491164fcf8b37d084076288534eed82
SSDEEP

768:9SVMqQCVaQkUwjWnoeE0nEhziO5OpBlgg6QfN8yQ4lyyUZzmojDN9us0ExvxOHez:cVMqFVaQbPE9hziGOpBlggLQyADDN5p3

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2508 wrote to memory of 3164	2508	regsvr32.exe	81
PID 2508 wrote to memory of 3164	2508	regsvr32.exe	81
PID 2508 wrote to memory of 3164	2508	regsvr32.exe	81

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\083ecbcd136ff8d393c91a121aefcdd3_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2508
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\083ecbcd136ff8d393c91a121aefcdd3_JaffaCakes118.dll
  2⤵
  PID:3164

memory/3164-0-0x00000000007A0000-0x00000000007B1000-memory.dmp

Filesize
68KB

Download