e66c697357cff3242f50f5a7efb81ce801a2552bed0bbce8c5b2a15a34a555ee

Analysis

max time kernel
93s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
12-07-2024 00:44

Target

3b5e5837153d3514cdba8200036c5ced_JaffaCakes118.dll
Size

122KB
MD5

3b5e5837153d3514cdba8200036c5ced
SHA1

8bd02d9ccd8720686950aac4052d567611e2660c
SHA256

e66c697357cff3242f50f5a7efb81ce801a2552bed0bbce8c5b2a15a34a555ee
SHA512

6e637378e2d3086ef713aad58b403e332851d9a5a0c4df380abec986d044a3d4fcf294cd26424386fe1448d22ecc534328d3ce053185b9806c818558cfbff851
SSDEEP

3072:+ByVkyjgoSGDxrc+MXVn1YKU7tBvYSL/u9zdK+44Ldh:+BiBjgE6+MXV1YFBvYC/MK+44x

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4452 wrote to memory of 528	4452	regsvr32.exe	83
PID 4452 wrote to memory of 528	4452	regsvr32.exe	83
PID 4452 wrote to memory of 528	4452	regsvr32.exe	83

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\3b5e5837153d3514cdba8200036c5ced_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4452
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\3b5e5837153d3514cdba8200036c5ced_JaffaCakes118.dll
  2⤵
  PID:528

memory/528-0-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/528-1-0x0000000000451000-0x0000000000452000-memory.dmp

Filesize
4KB

Download