06631345d0e8f5cd1dfeba4114b963782f7d39bea7335fae5de7e2e18360c436

Analysis

max time kernel
93s
max time network
131s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
13-07-2024 16:45

Target

42849b0c3ee88ffe16233fdb1385da34_JaffaCakes118.dll
Size

44KB
MD5

42849b0c3ee88ffe16233fdb1385da34
SHA1

94611f9d9d5a315daf9ac8b020fdf9cd1aff0ec2
SHA256

06631345d0e8f5cd1dfeba4114b963782f7d39bea7335fae5de7e2e18360c436
SHA512

d97c774621a18dd1c8170ff9e83325bfe549cfa5f3f6159be4cdeec0d61306a17f65e78a2e42d57677fa8032a2d430a97bfab62f955b2a9440b61eeb2ef439f2
SSDEEP

768:PGjFt+BHkIaydteDAu/1RTpkavHatEWRWeUcQtEXgLa1V6:+hvxgwce9LaP

Score

1^/10

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2340	Rundll32.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2340	Rundll32.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4872 wrote to memory of 4304	4872	regsvr32.exe	83
PID 4872 wrote to memory of 4304	4872	regsvr32.exe	83
PID 4872 wrote to memory of 4304	4872	regsvr32.exe	83
PID 4304 wrote to memory of 2340	4304	regsvr32.exe	84
PID 4304 wrote to memory of 2340	4304	regsvr32.exe	84
PID 4304 wrote to memory of 2340	4304	regsvr32.exe	84

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\42849b0c3ee88ffe16233fdb1385da34_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4872
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\42849b0c3ee88ffe16233fdb1385da34_JaffaCakes118.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4304
- - C:\Windows\SysWOW64\Rundll32.exe
    C:\Windows\system32\Rundll32.exe C:\Users\Admin\AppData\Local\Temp\42849b0c3ee88ffe16233fdb1385da34_JaffaCakes118.dll,DllUnregisterServer
    3⤵
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    PID:2340