52013e6b7baafd563f334478fcd8d58c323d48e2a669e8254005c1f899bf22a1

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
11-07-2024 11:45

Target

38fae1c1760612e2a99bdcaf2df88a85_JaffaCakes118.dll
Size

52KB
MD5

38fae1c1760612e2a99bdcaf2df88a85
SHA1

c9e49496adbc7f771a7abe14f57857b697b3f3b7
SHA256

52013e6b7baafd563f334478fcd8d58c323d48e2a669e8254005c1f899bf22a1
SHA512

41d29f61d0a0a18a6d321da3592fce4167221eb99f2c37b7de8457cacce9aea8f2269637331f0050d04021644f2f3775e08eb9a36cb92cc9d576e7de6020e13f
SSDEEP

1536:kYzQit3teE2SW7rJYpq3x4EeSnFZmxAjnouy8:kYkMdVq7rJYk3mEeiTmxKout

Score

1^/10

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000000-0000-0000-0000-000000000000}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000000-0000-0000-0000-000000000000}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\38fae1c1760612e2a99bdcaf2df88a85_JaffaCakes118.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000000-0000-0000-0000-000000000000}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000000-0000-0000-0000-000000000000}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000000-0000-0000-0000-000000000000}\	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2104 wrote to memory of 4752	2104	regsvr32.exe	83
PID 2104 wrote to memory of 4752	2104	regsvr32.exe	83
PID 2104 wrote to memory of 4752	2104	regsvr32.exe	83

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\38fae1c1760612e2a99bdcaf2df88a85_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2104
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\38fae1c1760612e2a99bdcaf2df88a85_JaffaCakes118.dll
  2⤵
  - Modifies registry class
  PID:4752

memory/4752-0-0x0000000000010000-0x0000000000044000-memory.dmp

Filesize
208KB

Download