212ce1aae5a295989f18356265a0cd37a076edb0c842a85d57ff3e0545502d34

Analysis

max time kernel
96s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
08-07-2024 21:17

Target

2dd51e2e438bf8ad91d0eebe1f628f66_JaffaCakes118.dll
Size

100KB
MD5

2dd51e2e438bf8ad91d0eebe1f628f66
SHA1

4865f402a707727c5a7725598b3735f09f5c091f
SHA256

212ce1aae5a295989f18356265a0cd37a076edb0c842a85d57ff3e0545502d34
SHA512

1e0f7c1983cd29f887ef80d2902c2fa82f697370f3fde95712490a7d18e8d21de3c9a0f3d2bab95983db1909b2438533daa8e544fd438eb5658e9aa78307fc84
SSDEEP

1536:SMqzW7JoS7qxgY96riqT2KazWkokkkkkkotV74wooRtVKy/f39g:S5OK1bzWkokkkkkkcVUwooR3H39

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2692 wrote to memory of 3636	2692	regsvr32.exe	82
PID 2692 wrote to memory of 3636	2692	regsvr32.exe	82
PID 2692 wrote to memory of 3636	2692	regsvr32.exe	82

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\2dd51e2e438bf8ad91d0eebe1f628f66_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2692
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\2dd51e2e438bf8ad91d0eebe1f628f66_JaffaCakes118.dll
  2⤵
  PID:3636

memory/3636-0-0x0000000010000000-0x0000000010019000-memory.dmp

Filesize
100KB

Download