64d2a60965716cd1cbb4a0109acc7aa8eb779e23e1fc1279713c3ca9344567e2

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
28/06/2024, 01:08

Target

183b44a20bea2a668a49fc957ddefc52_JaffaCakes118.dll
Size

44KB
MD5

183b44a20bea2a668a49fc957ddefc52
SHA1

a57491f54369d52401f8d83158a4335236b3648a
SHA256

64d2a60965716cd1cbb4a0109acc7aa8eb779e23e1fc1279713c3ca9344567e2
SHA512

e5ebf829664a591e7dbd96989d2ab2c58e047addea52da2e340d1df83de93711650750ebdd781c527eef106b4a570230991f5bbce3ba7efd9fd44df8feec56ea
SSDEEP

768:GOsSTVimetB2WNJ3CRpkavO47iSFZjQ9gLa1D:TT5et1N78OW/La9

Score

1^/10

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4656	Rundll32.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4656	Rundll32.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3224 wrote to memory of 3200	3224	regsvr32.exe	80
PID 3224 wrote to memory of 3200	3224	regsvr32.exe	80
PID 3224 wrote to memory of 3200	3224	regsvr32.exe	80
PID 3200 wrote to memory of 4656	3200	regsvr32.exe	81
PID 3200 wrote to memory of 4656	3200	regsvr32.exe	81
PID 3200 wrote to memory of 4656	3200	regsvr32.exe	81

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\183b44a20bea2a668a49fc957ddefc52_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3224
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\183b44a20bea2a668a49fc957ddefc52_JaffaCakes118.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3200
- - C:\Windows\SysWOW64\Rundll32.exe
    C:\Windows\system32\Rundll32.exe C:\Users\Admin\AppData\Local\Temp\183b44a20bea2a668a49fc957ddefc52_JaffaCakes118.dll,DllUnregisterServer
    3⤵
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    PID:4656