3127d0933d87e19c6f5a25c6f0e738d1309da5f5f5314cd3d50f30505ab83ba9

Analysis

max time kernel
138s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
22/07/2024, 17:13

Target

640ec0202573a7157b8aab0425b9040e_JaffaCakes118.dll
Size

97KB
MD5

640ec0202573a7157b8aab0425b9040e
SHA1

7a9bc36184eb3be8391b06723509750a20eb777a
SHA256

3127d0933d87e19c6f5a25c6f0e738d1309da5f5f5314cd3d50f30505ab83ba9
SHA512

45a342109843fd45f9650ef1c51e935bf49f00f305022a4d8ea38cc821720f2b650977871f26f45995f87d404e137cd88c93447b90888cfe8c87c17c540468ff
SSDEEP

1536:5MqzW7JoS7qxgY96riqT2KazWkokkkkkkotV74wooRa1rq4C:55OK1bzWkokkkkkkcVUwooRa1rx

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4696 wrote to memory of 3180	4696	regsvr32.exe	84
PID 4696 wrote to memory of 3180	4696	regsvr32.exe	84
PID 4696 wrote to memory of 3180	4696	regsvr32.exe	84

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\640ec0202573a7157b8aab0425b9040e_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4696
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\640ec0202573a7157b8aab0425b9040e_JaffaCakes118.dll
  2⤵
  PID:3180

memory/3180-0-0x0000000010000000-0x0000000010018000-memory.dmp

Filesize
96KB

Download