d275576cfe12405a9ac53e9c02d223e1b2be7f6c3245e25749f13ecf19415bcf

Analysis

max time kernel
147s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
18/04/2024, 23:50

Target

f906bd017ea576cc3de969acc5ab5212_JaffaCakes118.dll
Size

117KB
MD5

f906bd017ea576cc3de969acc5ab5212
SHA1

f2d515ef8f8109f3fafcab6892e67e872eb1cc67
SHA256

d275576cfe12405a9ac53e9c02d223e1b2be7f6c3245e25749f13ecf19415bcf
SHA512

7848ae2ba820c52938a2f010ddd55c8bef8efd38f1c9996ad6e67f5226f7cb30199c8b8f6549438207b603cc56396c2a3e05e8ba0302326975afeff45e650923
SSDEEP

3072:xJYfCasEo39ENlCo5Vzv+ykAxisbiKhcIp5hD5wjVZb:xy6yeENJRN5xXVrpOBZb

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 736 wrote to memory of 2692	736	regsvr32.exe	85
PID 736 wrote to memory of 2692	736	regsvr32.exe	85
PID 736 wrote to memory of 2692	736	regsvr32.exe	85

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\f906bd017ea576cc3de969acc5ab5212_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:736
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\f906bd017ea576cc3de969acc5ab5212_JaffaCakes118.dll
  2⤵
  PID:2692

memory/2692-0-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/2692-1-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download