04639ca0ef84975dec49a2600693326ccbb0bda2d2c6f04dcc93f366ae2f5549

Analysis

max time kernel
93s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
15/07/2024, 13:53

Target

49f700ed2441be347ee14cbedc90abf6_JaffaCakes118.dll
Size

2.3MB
MD5

49f700ed2441be347ee14cbedc90abf6
SHA1

c69333764cb00dc707816d866f018078bfd64a58
SHA256

04639ca0ef84975dec49a2600693326ccbb0bda2d2c6f04dcc93f366ae2f5549
SHA512

4f49f3bf02ad46520dad1f5d248b55d52043493eb26f778f32da03961de9fd064eb64aea7e9e18bc1a04b9338e0b8b8919efc91bb8fad0398219e905d1aae303
SSDEEP

49152:mwdwvVkFsUN2uEcpI75b3/cwnuIrmLPoBPJf6lT2MiG:WvVANIuEgQ3/1gDoBhfC2MiG

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3716 wrote to memory of 3212	3716	regsvr32.exe	83
PID 3716 wrote to memory of 3212	3716	regsvr32.exe	83
PID 3716 wrote to memory of 3212	3716	regsvr32.exe	83

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\49f700ed2441be347ee14cbedc90abf6_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3716
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\49f700ed2441be347ee14cbedc90abf6_JaffaCakes118.dll
  2⤵
  PID:3212

memory/3212-0-0x0000000002940000-0x0000000002AEB000-memory.dmp

Filesize
1.7MB

Download
memory/3212-1-0x0000000002940000-0x0000000002AEB000-memory.dmp

Filesize
1.7MB

Download