a4c362d623147c75dcd2b9b5ba0463576e5a0a271e0d14f1dfd561df1fe5f3f6

Analysis

max time kernel
41s
max time network
49s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03/07/2024, 03:24

Target

20ebd2a9e3294fbd62add8bb5e568756_JaffaCakes118.dll
Size

18KB
MD5

20ebd2a9e3294fbd62add8bb5e568756
SHA1

12ffbf934a884c0858c9b0d3c7a03f14e6638d4e
SHA256

a4c362d623147c75dcd2b9b5ba0463576e5a0a271e0d14f1dfd561df1fe5f3f6
SHA512

2a65854e22cf6b507750f0dcd8385df59a3c8e5f0fdad9181a776904df1a8b54abdf28d761eff2d73d82951a3cff2786f6947ef9b2b4f3a8f6768b14bcb61aca
SSDEEP

192:JBv5P1RdqOs0U87+SZA5U2tqdAiDtFlNlJuXJMCIJO8DVGEeDzq6Ld:lLdZs0U8gULACDlNlJYKO3EoG

Score

1^/10

Modifies registry class 6 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{781FBCC1-99C7-4AE0-95F7-66EA49E86DD7}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\20ebd2a9e3294fbd62add8bb5e568756_JaffaCakes118.dll"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{781FBCC1-99C7-4AE0-95F7-66EA49E86DD7}\InprocServer32\ThreadingModel = "Apartment"	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{781FBCC1-99C7-4AE0-95F7-66EA49E86DD7}\InprocServer32	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{781FBCC1-99C7-4AE0-95F7-66EA49E86DD7}	rundll32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1832	rundll32.exe
1832	rundll32.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3904 wrote to memory of 1832	3904	rundll32.exe	80
PID 3904 wrote to memory of 1832	3904	rundll32.exe	80
PID 3904 wrote to memory of 1832	3904	rundll32.exe	80
PID 1832 wrote to memory of 3424	1832	rundll32.exe	56

memory/1832-0-0x0000000010000000-0x0000000010007000-memory.dmp

Filesize
28KB

Download