c850ba8bd11fbc5df3bece177adb6acb97f832b19964b0ea6599438b244f140f

Analysis

max time kernel
95s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
19/07/2024, 16:21

Target

5cb59b86bf7c838fe0bb76276cebc5b8_JaffaCakes118.dll
Size

48KB
MD5

5cb59b86bf7c838fe0bb76276cebc5b8
SHA1

7709fefdfb2eb81f0f37297fbfa50c22b4be0470
SHA256

c850ba8bd11fbc5df3bece177adb6acb97f832b19964b0ea6599438b244f140f
SHA512

fc44c9f5cb4f53f2cde009ade7ff057a4f5101542b2766809ec793ed2cea237ce472ddc530663ae9369a946384800f81dbebf10340c98137f4d332096525b251
SSDEEP

768:5JqFgOvH6CISzuKvcLXs8AGPoIfNfvI0mOYbZVou9y2JuUQ37ty8G:5gCSTcL8uPoIVfvT/60ZdU8

Score

1^/10

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4964	Rundll32.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4964	Rundll32.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2808 wrote to memory of 2936	2808	regsvr32.exe	84
PID 2808 wrote to memory of 2936	2808	regsvr32.exe	84
PID 2808 wrote to memory of 2936	2808	regsvr32.exe	84
PID 2936 wrote to memory of 4964	2936	regsvr32.exe	85
PID 2936 wrote to memory of 4964	2936	regsvr32.exe	85
PID 2936 wrote to memory of 4964	2936	regsvr32.exe	85

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\5cb59b86bf7c838fe0bb76276cebc5b8_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2808
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\5cb59b86bf7c838fe0bb76276cebc5b8_JaffaCakes118.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2936
- - C:\Windows\SysWOW64\Rundll32.exe
    C:\Windows\system32\Rundll32.exe C:\Users\Admin\AppData\Local\Temp\5cb59b86bf7c838fe0bb76276cebc5b8_JaffaCakes118.dll,DllUnregisterServer
    3⤵
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    PID:4964