ace8b9084c69d761fc4d0e9bd5b53b69a274d3e25a3c0ebdff438a25a78c40d9

Analysis

max time kernel
139s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
23/07/2024, 00:53

Target

658048231aca5ec436e3a1f58c5934f8_JaffaCakes118.dll
Size

21KB
MD5

658048231aca5ec436e3a1f58c5934f8
SHA1

ca29b12e00e65bc1322025520f79f6fe48cf7994
SHA256

ace8b9084c69d761fc4d0e9bd5b53b69a274d3e25a3c0ebdff438a25a78c40d9
SHA512

296ad5420b65333a2d50fc3e47ad2b82bd3cfb683fc4917e93d569ba1b9ce8b77d769e844bc7ab29073fd08102d4f7b3f2a1cd4d857fa063356f0812c034715a
SSDEEP

384:e5Bnb2vDPEkrbXDcZo9EmpPNbnKNvGdfPEShuuDKqYoF0Ay+8fOEmO4zGKhtLyy:Wb2LGomm1N0vGFPFhQoCt1mO4LhtP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1140 wrote to memory of 3628	1140	regsvr32.exe	84
PID 1140 wrote to memory of 3628	1140	regsvr32.exe	84
PID 1140 wrote to memory of 3628	1140	regsvr32.exe	84

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\658048231aca5ec436e3a1f58c5934f8_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1140
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\658048231aca5ec436e3a1f58c5934f8_JaffaCakes118.dll
  2⤵
  PID:3628

memory/3628-0-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/3628-1-0x00000000009F0000-0x00000000009F1000-memory.dmp

Filesize
4KB

Download
memory/3628-2-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download