104a865fe4cfbe8b963cff5dbe89f208cd561d9868eab08c0129c9099be74c77

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
04/07/2024, 06:37

Target

24f7ce9e356435304776b2bf4160a58e_JaffaCakes118.dll
Size

124KB
MD5

24f7ce9e356435304776b2bf4160a58e
SHA1

7926bbdda033fec0a462ed4987b1cc4ed5cafe92
SHA256

104a865fe4cfbe8b963cff5dbe89f208cd561d9868eab08c0129c9099be74c77
SHA512

260e6d0c6683e04e4dd16b3f06b5add7b7b652046c6376b20b761e1cba6c96764b0f2c215fe010eafea2621461afa54d9ac785d9d5db32aa4cc3e4e08e8d6efc
SSDEEP

3072:eUXOt+qvmnLYueuQW8wB0AjVdSnPM1NDhckHKHD:b+x+LYueznwaASPSNNTKH

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3300 wrote to memory of 4664	3300	regsvr32.exe	83
PID 3300 wrote to memory of 4664	3300	regsvr32.exe	83
PID 3300 wrote to memory of 4664	3300	regsvr32.exe	83

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\24f7ce9e356435304776b2bf4160a58e_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3300
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\24f7ce9e356435304776b2bf4160a58e_JaffaCakes118.dll
  2⤵
  PID:4664

memory/4664-1-0x0000000001F10000-0x0000000001F61000-memory.dmp

Filesize
324KB

Download
memory/4664-2-0x0000000001F10000-0x0000000001F61000-memory.dmp

Filesize
324KB

Download
memory/4664-0-0x0000000001F10000-0x0000000001F61000-memory.dmp

Filesize
324KB

Download
memory/4664-3-0x0000000001F41000-0x0000000001F60000-memory.dmp

Filesize
124KB

Download