d4c3f5635f4144013d30d955109ad780fd562921733adb869ad768b34526949b

Analysis

max time kernel
143s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
19/07/2024, 18:57

Target

5d3e4aa7e94816d94518af5006913950_JaffaCakes118.dll
Size

126KB
MD5

5d3e4aa7e94816d94518af5006913950
SHA1

39656141135bb8c3c859930e8d7640b7783a56f9
SHA256

d4c3f5635f4144013d30d955109ad780fd562921733adb869ad768b34526949b
SHA512

fe270c8814994311be729858396ddfdeea229d34ce352d084684c260cabb1c22ba6541b80b6069186bd81b3cc145a90e26ccd0492a42cfe9509cbc7aa44ba48c
SSDEEP

3072:jMpULWUYD1FoYehxX7rLrJ2NWynkRNBI6P1qiyO:AGqUOuvhdn7IM

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2852 wrote to memory of 4716	2852	regsvr32.exe	84
PID 2852 wrote to memory of 4716	2852	regsvr32.exe	84
PID 2852 wrote to memory of 4716	2852	regsvr32.exe	84

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\5d3e4aa7e94816d94518af5006913950_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2852
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\5d3e4aa7e94816d94518af5006913950_JaffaCakes118.dll
  2⤵
  PID:4716

memory/4716-0-0x00000000003D0000-0x00000000003F4000-memory.dmp

Filesize
144KB

Download