42b6382a52d3607aa193052d5c710ac4a831710fd3853b426730ad9206d030b5

Analysis

max time kernel
147s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
04/07/2024, 00:44

Target

240ee04504654519670c00a3212d3669_JaffaCakes118.dll
Size

97KB
MD5

240ee04504654519670c00a3212d3669
SHA1

9116444709be36df3203d651b671d35a19b96258
SHA256

42b6382a52d3607aa193052d5c710ac4a831710fd3853b426730ad9206d030b5
SHA512

18a1499cae19d839eedb8dab6eb80ae9901862d34a46f3fad41c79d82803c6e098f9a0ed297acca25cd9ecdd5797a4c7d1b0660a7b2bd386873a9e6814b924a4
SSDEEP

1536:NMqzW7JoS7qxgY96riqT2KazWkokkkkkkotV74wooRHl6w:N5OK1bzWkokkkkkkcVUwooRH

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5060 wrote to memory of 4524	5060	regsvr32.exe	82
PID 5060 wrote to memory of 4524	5060	regsvr32.exe	82
PID 5060 wrote to memory of 4524	5060	regsvr32.exe	82

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\240ee04504654519670c00a3212d3669_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:5060
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\240ee04504654519670c00a3212d3669_JaffaCakes118.dll
  2⤵
  PID:4524

memory/4524-0-0x0000000010000000-0x0000000010018000-memory.dmp

Filesize
96KB

Download