42b2cd4dad1ea294300fdb103915ee535587e7f90288cab710b659467234fe82

Analysis

max time kernel
87s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
19/04/2024, 00:39

Target
f91e23d2d279086f5457d7af1dba0ccd_JaffaCakes118.dll
Size 4.9MB
Sample240419-azq94abe27
SHA256 42b2cd4dad1ea294300fdb103915ee535587e7f90288cab710b659467234fe82
MD5 f91e23d2d279086f5457d7af1dba0ccd
SHA1 d3ea37c75227f62df1c107ed43afe2d1c9598e5c
SHA512 11c7bae7c3e41fce23c09f3cdcc78201beba82810bd9b0877d21faa61e32a3e9bf098c73faa81e96333fda8ce8f434e28375f4c14ab9596bd1091ed7785baa0d
SSDEEP 98304:0XJbjOdRTNhVNwb64wmsBtAJzVTx+HzF0dFGNi0mSG6GH63Ju6eGj:mJ4T9N/esBOJz9xoh03G0fP63JuQ
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3624 wrote to memory of 1560	3624	regsvr32.exe	83
PID 3624 wrote to memory of 1560	3624	regsvr32.exe	83
PID 3624 wrote to memory of 1560	3624	regsvr32.exe	83

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\f91e23d2d279086f5457d7af1dba0ccd_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3624
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\f91e23d2d279086f5457d7af1dba0ccd_JaffaCakes118.dll
  2⤵
  PID:1560