3d9a733cd8ffc20ca91a932e599201d30538391d37af69449f19dd3c017c6bba

Analysis

max time kernel
93s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
27-06-2024 10:11

Target

159c83ada9340a4b65f0c0670c96d73a_JaffaCakes118.dll
Size

58KB
MD5

159c83ada9340a4b65f0c0670c96d73a
SHA1

3dc0423ad1f392601ce74adb357233a089a3b039
SHA256

3d9a733cd8ffc20ca91a932e599201d30538391d37af69449f19dd3c017c6bba
SHA512

01d37aac259c084c3b43c022f0cea7b6af6abe142b8a7a1308eb6d7a0b4f3c10c86ca7097f94593c1fc0f90e5653a1b84970b5ffce0c4c20b7d10556ae8f21e6
SSDEEP

1536:IIyEWrI7iHyrDWjOtNlIQhYIhAkoEyORrDmGNJQUw7b76G4Tjs:IITFiHCDcLUhloEyUo6dP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4824 wrote to memory of 1292	4824	regsvr32.exe	81
PID 4824 wrote to memory of 1292	4824	regsvr32.exe	81
PID 4824 wrote to memory of 1292	4824	regsvr32.exe	81

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\159c83ada9340a4b65f0c0670c96d73a_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4824
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\159c83ada9340a4b65f0c0670c96d73a_JaffaCakes118.dll
  2⤵
  PID:1292

memory/1292-0-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/1292-2-0x00000000007F0000-0x00000000007F1000-memory.dmp

Filesize
4KB

Download
memory/1292-1-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download