79d373ccd981b8c799e14fb48e859c6f3791bf1722a671d63afc65b2b9400660

Analysis

max time kernel
150s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
22/07/2024, 13:54

Target

636e38e882cb0efd80e1b9654072215e_JaffaCakes118.dll
Size

96KB
MD5

636e38e882cb0efd80e1b9654072215e
SHA1

73eb672d7d698d02c14d52f5466477c117864626
SHA256

79d373ccd981b8c799e14fb48e859c6f3791bf1722a671d63afc65b2b9400660
SHA512

c4c86447c186b423d84d4baefbe89c040d2d137d9b162c2b51909f7c6ff37584c2f348ba89e1c1787409e878a448ca02f44e648b96459a727517e0ec816bfd3a
SSDEEP

1536:xMqzW7JoS7qxgY96riqT2KazWkokkkkkkotV74wooRGCGNg:x5OK1bzWkokkkkkkcVUwooRGT

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 632 wrote to memory of 1400	632	regsvr32.exe	86
PID 632 wrote to memory of 1400	632	regsvr32.exe	86
PID 632 wrote to memory of 1400	632	regsvr32.exe	86

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\636e38e882cb0efd80e1b9654072215e_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:632
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\636e38e882cb0efd80e1b9654072215e_JaffaCakes118.dll
  2⤵
  PID:1400

memory/1400-0-0x0000000010000000-0x0000000010018000-memory.dmp

Filesize
96KB

Download