903a7211fecf9e698f7c494d4274ca23e1a311a2fbb4818bb0821b0d3f9a3e5e

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
28/06/2024, 03:21

Target

1899a19658051018c294c827db8ee045_JaffaCakes118.dll
Size

73KB
MD5

1899a19658051018c294c827db8ee045
SHA1

af34b64b23bef9d36ce3680b0e5603e6eea3efa3
SHA256

903a7211fecf9e698f7c494d4274ca23e1a311a2fbb4818bb0821b0d3f9a3e5e
SHA512

3bb28a97d3a759625b83abea09e8009feaabe8ae8e3ca89acd026c758f0bc0fc224cdf60a09b451bf75a2fb37df251177d45adb9de7deb73a7621e82931fc1ff
SSDEEP

1536:p7A74ZIjAljg3Ngps6gKcWY+bUntygQvRVKlSt/tIVmCFwAv:p7A75jcjg3N4/gKM+bUtaLKatIVmKwA

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1924 wrote to memory of 1120	1924	regsvr32.exe	83
PID 1924 wrote to memory of 1120	1924	regsvr32.exe	83
PID 1924 wrote to memory of 1120	1924	regsvr32.exe	83

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\1899a19658051018c294c827db8ee045_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1924
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\1899a19658051018c294c827db8ee045_JaffaCakes118.dll
  2⤵
  PID:1120

memory/1120-0-0x0000000010000000-0x0000000010050000-memory.dmp

Filesize
320KB

Download
memory/1120-1-0x0000000010001000-0x000000001003D000-memory.dmp

Filesize
240KB

Download