8b5fe24e2cbdb9e5ad94fe47f61af2094736e7be789caf3657bf6b1cf5e30b8c

Analysis

max time kernel
125s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
01/07/2024, 17:57

Target

1bf58eeb05516916e39e5ea55e5a6bc7_JaffaCakes118.dll
Size

27KB
MD5

1bf58eeb05516916e39e5ea55e5a6bc7
SHA1

0d6f07fa6c94e1902909f542c34f9c6916a08448
SHA256

8b5fe24e2cbdb9e5ad94fe47f61af2094736e7be789caf3657bf6b1cf5e30b8c
SHA512

484a5af5f9cb58d1efa8d9813d759f292ebd0335c3b5f5709d63e11d56c2b2af368cae63072802d5b9ecb00b9ef1e039c7131b7810be30e53dd613eef194fad8
SSDEEP

384:2xr/6vzp1t8YPPGbU/xBD1HC2eO8fyVm+8jQQwZNKvKDp+m/PeekGL:2x7Sp4OPqU573z86CjzWTDp+YPe0

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 936 wrote to memory of 1532	936	regsvr32.exe	88
PID 936 wrote to memory of 1532	936	regsvr32.exe	88
PID 936 wrote to memory of 1532	936	regsvr32.exe	88

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\1bf58eeb05516916e39e5ea55e5a6bc7_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:936
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\1bf58eeb05516916e39e5ea55e5a6bc7_JaffaCakes118.dll
  2⤵
  PID:1532

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3988,i,18168883380598738769,14202261231630113808,262144 --variations-seed-version --mojo-platform-channel-handle=4300 /prefetch:8
1⤵
PID:3000