1f8e0ef4cf1cacfd2525a798807c1dd23152a42a4091793c4eb3a3b01dba330b

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
06-07-2024 08:31

Target

27e8385a52d98508c6a0133c72c7ce15_JaffaCakes118.dll
Size

117KB
MD5

27e8385a52d98508c6a0133c72c7ce15
SHA1

9c02275df075c8647e2285aa685b753cb117c0b6
SHA256

1f8e0ef4cf1cacfd2525a798807c1dd23152a42a4091793c4eb3a3b01dba330b
SHA512

525d2c5ce8a8f6525cc081dba827ef9d46b37c152181a5728b9e780702645a74495b890b584dabe2bcc1e4a62198c217e689778c92b7f301621f20bc28bc10e6
SSDEEP

3072:TcCP8l8VutkQPFyQQz70DXdbRLTvmM24UxyV:TXUleuyQPFQz7CRL7mMYxyV

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4324 wrote to memory of 3100	4324	regsvr32.exe	82
PID 4324 wrote to memory of 3100	4324	regsvr32.exe	82
PID 4324 wrote to memory of 3100	4324	regsvr32.exe	82

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\27e8385a52d98508c6a0133c72c7ce15_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4324
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\27e8385a52d98508c6a0133c72c7ce15_JaffaCakes118.dll
  2⤵
  PID:3100

memory/3100-0-0x0000000000880000-0x00000000008D0000-memory.dmp

Filesize
320KB

Download
memory/3100-2-0x0000000000880000-0x00000000008D0000-memory.dmp

Filesize
320KB

Download
memory/3100-1-0x00000000008CD000-0x00000000008CE000-memory.dmp

Filesize
4KB

Download