af37292ed7fd695662f54c0556400a57dec532336d0ba9f49003dea77e543c12

Analysis

max time kernel
139s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
22-07-2024 16:20

Target

63e5411f81870b74354516fdf292b73e_JaffaCakes118.dll
Size

97KB
MD5

63e5411f81870b74354516fdf292b73e
SHA1

606b18eebd0d7f1be2213ed88093bfad3ae0ac1d
SHA256

af37292ed7fd695662f54c0556400a57dec532336d0ba9f49003dea77e543c12
SHA512

208673618d563a18d9bd38251e0b55d1ac1d8c411f881e769a7c62cbbcab5d62f213cded032d3d496bbdfbab740064f438e4c2e9abd072371c5fda246cc301ce
SSDEEP

1536:KMqzW7JoS7qxgY96riqT2KazWkokkkkkkotV74wooR48+eNaa:K5OK1bzWkokkkkkkcVUwooRfNa

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3428 wrote to memory of 3060	3428	regsvr32.exe	84
PID 3428 wrote to memory of 3060	3428	regsvr32.exe	84
PID 3428 wrote to memory of 3060	3428	regsvr32.exe	84

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\63e5411f81870b74354516fdf292b73e_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3428
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\63e5411f81870b74354516fdf292b73e_JaffaCakes118.dll
  2⤵
  PID:3060

memory/3060-0-0x0000000010000000-0x0000000010018000-memory.dmp

Filesize
96KB

Download