46a6835e16088865764dad14619a5e7984eb7c924549bb0291bae0cc7f53abd0

Analysis

max time kernel
92s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
12/07/2024, 02:15

Target

3ba1ad871857c77f135a1c67baf88d20_JaffaCakes118.dll
Size

97KB
MD5

3ba1ad871857c77f135a1c67baf88d20
SHA1

af31a81188fdd1bd1ca012f5b8d5cf4806d18172
SHA256

46a6835e16088865764dad14619a5e7984eb7c924549bb0291bae0cc7f53abd0
SHA512

a4f69545460b02a8b2a40394fad89c41b178fc8804b003d8bc35a23c58af37bbf0cf3dc423a50b130a50587cd9797dc9a1fa87027ef944d3a23269c99177c7f6
SSDEEP

1536:IMqzW7JoS7qxgY96riqT2KazWkokkkkkkotV74wooRvN87x/:I5OK1bzWkokkkkkkcVUwooRW7

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1932 wrote to memory of 1476	1932	regsvr32.exe	83
PID 1932 wrote to memory of 1476	1932	regsvr32.exe	83
PID 1932 wrote to memory of 1476	1932	regsvr32.exe	83

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\3ba1ad871857c77f135a1c67baf88d20_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1932
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\3ba1ad871857c77f135a1c67baf88d20_JaffaCakes118.dll
  2⤵
  PID:1476

memory/1476-0-0x0000000010000000-0x0000000010018000-memory.dmp

Filesize
96KB

Download