42b2cd4dad1ea294300fdb103915ee535587e7f90288cab710b659467234fe82

Analysis

max time kernel
87s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
19-04-2024 00:39

Target

f91e23d2d279086f5457d7af1dba0ccd_JaffaCakes118.dll
Size

4.9MB
MD5

f91e23d2d279086f5457d7af1dba0ccd
SHA1

d3ea37c75227f62df1c107ed43afe2d1c9598e5c
SHA256

42b2cd4dad1ea294300fdb103915ee535587e7f90288cab710b659467234fe82
SHA512

11c7bae7c3e41fce23c09f3cdcc78201beba82810bd9b0877d21faa61e32a3e9bf098c73faa81e96333fda8ce8f434e28375f4c14ab9596bd1091ed7785baa0d
SSDEEP

98304:0XJbjOdRTNhVNwb64wmsBtAJzVTx+HzF0dFGNi0mSG6GH63Ju6eGj:mJ4T9N/esBOJz9xoh03G0fP63JuQ

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 3624 wrote to memory of 1560	3624	regsvr32.exe	regsvr32.exe
PID 3624 wrote to memory of 1560	3624	regsvr32.exe	regsvr32.exe
PID 3624 wrote to memory of 1560	3624	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\f91e23d2d279086f5457d7af1dba0ccd_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3624
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\f91e23d2d279086f5457d7af1dba0ccd_JaffaCakes118.dll
  2⤵
  PID:1560