f3ff77367ce2b47d3ec6108430a7be47f0b4a47c728fffc47f2eff9053e3e518

Analysis

max time kernel
95s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
10/07/2024, 21:31

Target

3677fa8eb76677290bfe0588931fdfbe_JaffaCakes118.dll
Size

364KB
MD5

3677fa8eb76677290bfe0588931fdfbe
SHA1

cb2937ed35c75e74b342a53d92460115239a95a5
SHA256

f3ff77367ce2b47d3ec6108430a7be47f0b4a47c728fffc47f2eff9053e3e518
SHA512

29f28bb88e2b37b96001d5f6d911b6bf60d44af6a1647c0c84cb79bc5ec23638f597d5f285e6060e837ad1481908e0ccbe0a722cd13ad8b7030a8956041b9b21
SSDEEP

6144:40HMfWvptE9w3uXhg1ylVOnhKP3ESrtMkECguee1Qj/43wYKP:LGWvpu9Wq4y8AVdgux1c43wf

Score

1^/10

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{039EA4C0-E696-11d0-878A-00A0C91EC756}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{039EA4C0-E696-11d0-878A-00A0C91EC756}\VersionIndependentProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{039EA4C0-E696-11d0-878A-00A0C91EC756}\ProgID	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2092 wrote to memory of 4348	2092	regsvr32.exe	83
PID 2092 wrote to memory of 4348	2092	regsvr32.exe	83
PID 2092 wrote to memory of 4348	2092	regsvr32.exe	83

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\3677fa8eb76677290bfe0588931fdfbe_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2092
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\3677fa8eb76677290bfe0588931fdfbe_JaffaCakes118.dll
  2⤵
  - Modifies registry class
  PID:4348

memory/4348-0-0x0000000004720000-0x000000000477B000-memory.dmp

Filesize
364KB

Download
memory/4348-2-0x0000000004720000-0x000000000477B000-memory.dmp

Filesize
364KB

Download
memory/4348-1-0x000000000474A000-0x0000000004773000-memory.dmp

Filesize
164KB

Download
memory/4348-3-0x0000000002E20000-0x0000000002E25000-memory.dmp

Filesize
20KB

Download
memory/4348-4-0x0000000002DD0000-0x0000000002DF5000-memory.dmp

Filesize
148KB

Download
memory/4348-5-0x0000000004720000-0x000000000477B000-memory.dmp

Filesize
364KB

Download
memory/4348-7-0x0000000002DD0000-0x0000000002DF5000-memory.dmp

Filesize
148KB

Download