95ed9a9024798d900a8d29bb6f86d379887c09158a76addd475da9f496b729b4

Analysis

max time kernel
93s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
10/07/2024, 22:20

Target

36a121e27da3b15d7a755f5b11a35458_JaffaCakes118.dll
Size

52KB
MD5

36a121e27da3b15d7a755f5b11a35458
SHA1

9dd1a08611c0c66a411e7f8cea01b75ef22e0ae7
SHA256

95ed9a9024798d900a8d29bb6f86d379887c09158a76addd475da9f496b729b4
SHA512

09f9f638471a80b0d0701c10b73bcc5f1af3fae8cbcfc2750333e948dd08125940dbe7118c915283b17b624d8d9f1153d336fd282a418d34745a713fde0182db
SSDEEP

1536:+BiRjolAySueIm1JJE3luHrctu/qS8CrDQ8fnadbnouy8:EYjM1nSLJE3lqrB8i0g6Dout

Score

1^/10

Modifies registry class 5 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000000-0000-0000-0000-000000000000}\	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000000-0000-0000-0000-000000000000}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000000-0000-0000-0000-000000000000}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\36a121e27da3b15d7a755f5b11a35458_JaffaCakes118.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000000-0000-0000-0000-000000000000}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000000-0000-0000-0000-000000000000}	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1948 wrote to memory of 3204	1948	regsvr32.exe	82
PID 1948 wrote to memory of 3204	1948	regsvr32.exe	82
PID 1948 wrote to memory of 3204	1948	regsvr32.exe	82

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\36a121e27da3b15d7a755f5b11a35458_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1948
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\36a121e27da3b15d7a755f5b11a35458_JaffaCakes118.dll
  2⤵
  - Modifies registry class
  PID:3204

memory/3204-0-0x0000000000010000-0x0000000000041000-memory.dmp

Filesize
196KB

Download