f55797f046b1b04931b78bb085d18f620fab7a77472c7a571bebd10b1791304a

Analysis

max time kernel
51s
max time network
51s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
28/06/2024, 10:10 UTC

Target

19be67e0356a3a292eaccbf41db640bb_JaffaCakes118.dll
Size

69KB
MD5

19be67e0356a3a292eaccbf41db640bb
SHA1

358a93de3b50a306bd61ca0d61caf45fe2449f53
SHA256

f55797f046b1b04931b78bb085d18f620fab7a77472c7a571bebd10b1791304a
SHA512

b927c2783d86850866a7b71410da8d8d326baa2ec945b471eadd95ea88fe3f5991ca239b0ee5cae48feca6ba6f26f336ac61f8cf7472df50dafcf55f49ba47e6
SSDEEP

1536:0d7jipTa3sbm9e5MqwUT1cf9ndgWul5U4wUyDPQRoXktf6:0dvlOcqwN7ylw4RoXkF6

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2816 wrote to memory of 920	2816	regsvr32.exe	80
PID 2816 wrote to memory of 920	2816	regsvr32.exe	80
PID 2816 wrote to memory of 920	2816	regsvr32.exe	80

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\19be67e0356a3a292eaccbf41db640bb_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2816
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\19be67e0356a3a292eaccbf41db640bb_JaffaCakes118.dll
  2⤵
  PID:920

memory/920-0-0x0000000000400000-0x0000000000449000-memory.dmp

Filesize
292KB

Download