4a48fd7cb14f2847f1442fb6f0d4fb76a56a2d7b60716683eeaa1efe9dc34fe4

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
20/06/2024, 02:35

Target
02161d0f82eca3d25b6a6c9795e62de9_JaffaCakes118.dll
Size 39KB
Sample240620-c28y2aydkj
SHA256 4a48fd7cb14f2847f1442fb6f0d4fb76a56a2d7b60716683eeaa1efe9dc34fe4
MD5 02161d0f82eca3d25b6a6c9795e62de9
SHA1 dbf36614831ebc7659d8b5e17bdf3b8294952ee5
SHA512 7a7f1dd416bff5d8cb3a23c26c747a9ba3eff911853cc3b70d4b77a2330b8981d81b60d1fdf673cb6c436c044bdd158ed21d98fad37df4a8c5f5e8b8cd258d5d
SSDEEP 768:u4OhGhMvln3l0fXlb2lgezgu86P5PM4swHUObpL:uzUMvZWfXIWeEChFRHBbp
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5020 wrote to memory of 3776	5020	regsvr32.exe	83
PID 5020 wrote to memory of 3776	5020	regsvr32.exe	83
PID 5020 wrote to memory of 3776	5020	regsvr32.exe	83

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\02161d0f82eca3d25b6a6c9795e62de9_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:5020
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\02161d0f82eca3d25b6a6c9795e62de9_JaffaCakes118.dll
  2⤵
  PID:3776