16bf28b1d3c45cb3ff9ab334658c794d0d6f84a29ba5fc078b3a40466c1b2e5f

Analysis

max time kernel
140s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
21/07/2024, 22:22

Target

61a2fe8ebbb5aed4a13f75d934313d76_JaffaCakes118.dll
Size

295KB
MD5

61a2fe8ebbb5aed4a13f75d934313d76
SHA1

ee1502009a70d8659eb10c125006dea7885b7d5c
SHA256

16bf28b1d3c45cb3ff9ab334658c794d0d6f84a29ba5fc078b3a40466c1b2e5f
SHA512

39641a93cb333d5b3a6d773d809615c72f8b78687ebd044eb936634ab1cbf11e23b2b8bdd459f6f0ed5641a719d3c7075f19f70c49f077b76107088f4af0fc74
SSDEEP

6144:ErbQ90rtLJXW7bNzkOSB15a9A27w5KW6cdphUSIYPzMwqBp85ZYCS:ErFJRobNzkOSg5W6cqSIYPzwp84CS

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3632 wrote to memory of 4056	3632	regsvr32.exe	84
PID 3632 wrote to memory of 4056	3632	regsvr32.exe	84
PID 3632 wrote to memory of 4056	3632	regsvr32.exe	84

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\61a2fe8ebbb5aed4a13f75d934313d76_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3632
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\61a2fe8ebbb5aed4a13f75d934313d76_JaffaCakes118.dll
  2⤵
  PID:4056

memory/4056-0-0x0000000000400000-0x00000000004CD000-memory.dmp

Filesize
820KB

Download
memory/4056-1-0x00000000009F0000-0x00000000009F2000-memory.dmp

Filesize
8KB

Download