40ffda8d8cb1311a91bfb6cc164f0b5ce3f0605846d5d9db4fd9dcaad1b2975e

Analysis

max time kernel
93s
max time network
100s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
15/07/2024, 11:55

Target

49ab8e42be2ac3bd8efc342a222b48ed_JaffaCakes118.dll
Size

105KB
MD5

49ab8e42be2ac3bd8efc342a222b48ed
SHA1

4e2d168d113c905c1791f4f5d0c8bd3585a52e7a
SHA256

40ffda8d8cb1311a91bfb6cc164f0b5ce3f0605846d5d9db4fd9dcaad1b2975e
SHA512

fde783a95e40bdcbea98b7433b31277b7c6ea1869429ddc7a0d7efb2e8ccf720731d6a6bdbba95e460e4da5af38a59f456cd2adf177cf6a50409987b6914e419
SSDEEP

1536:DMqzW7JoS7qxgY96riqT2KazWkokkkkkkotV74wooRBemxQ6ph5l:D5OK1bzWkokkkkkkcVUwooRUmx3

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5012 wrote to memory of 5096	5012	regsvr32.exe	83
PID 5012 wrote to memory of 5096	5012	regsvr32.exe	83
PID 5012 wrote to memory of 5096	5012	regsvr32.exe	83

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\49ab8e42be2ac3bd8efc342a222b48ed_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:5012
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\49ab8e42be2ac3bd8efc342a222b48ed_JaffaCakes118.dll
  2⤵
  PID:5096

memory/5096-0-0x0000000010000000-0x000000001001A000-memory.dmp

Filesize
104KB

Download