0011ff95aeb4e78b6e5c0187bb2ee422d2a70bc33beb5716bdcaf2b844b52324

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
09/07/2024, 23:29

Target

326ce3d5c4e0e5eb3ba51e48c4469381_JaffaCakes118.dll
Size

152KB
MD5

326ce3d5c4e0e5eb3ba51e48c4469381
SHA1

4557a3442d21dbd7b3472c32dd02a2e5d6fe832d
SHA256

0011ff95aeb4e78b6e5c0187bb2ee422d2a70bc33beb5716bdcaf2b844b52324
SHA512

f312c0d3e2f1b3f2aadf5c61433c68e30da3b77f9de713cad66257ec56d6040042b934d6b26f2a68a4d8a8a33e138ee2c10d1ae3f13fb634427b7c14b1adc117
SSDEEP

3072:7mSIInsd/35Yi5RXjigJhRmmheAAmMyZaifrOOMT:yS7sxpY+XjigLRReFbyZaiL

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4664 wrote to memory of 652	4664	regsvr32.exe	81
PID 4664 wrote to memory of 652	4664	regsvr32.exe	81
PID 4664 wrote to memory of 652	4664	regsvr32.exe	81

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\326ce3d5c4e0e5eb3ba51e48c4469381_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4664
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\326ce3d5c4e0e5eb3ba51e48c4469381_JaffaCakes118.dll
  2⤵
  PID:652

memory/652-0-0x000000006D4C0000-0x000000006D4E6000-memory.dmp

Filesize
152KB

Download