8644d99c6e4d2b2c8bc6facaa79cfab40dc47fd768b1e6ef92008cba411451de

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
22/07/2024, 08:40

Target

628b5fe17b0eede85d2df5f041b2e019_JaffaCakes118.dll
Size

100KB
MD5

628b5fe17b0eede85d2df5f041b2e019
SHA1

b976e987e86b18cef8c78c2bd04bdb86a40def3f
SHA256

8644d99c6e4d2b2c8bc6facaa79cfab40dc47fd768b1e6ef92008cba411451de
SHA512

4954f45f79185f81e55a8dc0b2ebd9be073f064420bb8115601ecf0e2bed5e5cc7598c76ab94a57551dc1c56dacb30cc8063cf280a2618d4a22494dad2aee2e0
SSDEEP

1536:DMqzW7JoS7qxgY96riqT2KazWkokkkkkkotV74wooRACg9EJt:D5OK1bzWkokkkkkkcVUwooRD6EJ

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4660 wrote to memory of 1420	4660	regsvr32.exe	84
PID 4660 wrote to memory of 1420	4660	regsvr32.exe	84
PID 4660 wrote to memory of 1420	4660	regsvr32.exe	84

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\628b5fe17b0eede85d2df5f041b2e019_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4660
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\628b5fe17b0eede85d2df5f041b2e019_JaffaCakes118.dll
  2⤵
  PID:1420

memory/1420-0-0x0000000010000000-0x0000000010019000-memory.dmp

Filesize
100KB

Download