5408306438afc7351ee724916ad75410a90843f00ee89a37bde4957af9e329f1

Analysis

max time kernel
137s
max time network
166s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
28/06/2024, 01:27

Target

1849b25e00a48db7baa620f828833f87_JaffaCakes118.dll
Size

130KB
MD5

1849b25e00a48db7baa620f828833f87
SHA1

abe8ec61e56566734c3488cb536c1f02555a1b56
SHA256

5408306438afc7351ee724916ad75410a90843f00ee89a37bde4957af9e329f1
SHA512

a505f051388902757050042f22ce6b50d1ac3f02e99157318e7d99f63f94e0904cb055ef342c2eada53a3a8646198f4aec036340203a5b4e9ece0031a99a646a
SSDEEP

3072:ri8lbcJ4fjYmvqDZltFZY2WuJ0ebMf8Zx+bxHkHboN2:rlbc+MPFZWuJ0eblxMiS2

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1396 wrote to memory of 2832	1396	regsvr32.exe	91
PID 1396 wrote to memory of 2832	1396	regsvr32.exe	91
PID 1396 wrote to memory of 2832	1396	regsvr32.exe	91

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\1849b25e00a48db7baa620f828833f87_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1396
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\1849b25e00a48db7baa620f828833f87_JaffaCakes118.dll
  2⤵
  PID:2832

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1340 --field-trial-handle=2292,i,2103142837140538807,15881446839139365070,262144 --variations-seed-version /prefetch:8
1⤵
PID:3612

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 2832 -ip 2832
1⤵
PID:2280

memory/2832-0-0x0000000000AB0000-0x0000000000B20000-memory.dmp

Filesize
448KB

Download
memory/2832-1-0x0000000000AB0000-0x0000000000B20000-memory.dmp

Filesize
448KB

Download
memory/2832-2-0x0000000000AB0000-0x0000000000B20000-memory.dmp

Filesize
448KB

Download