fdaa27b5053b6ac0b3b0600f377725ca006072b2a32239667e54a0083e7e94f0

Analysis

max time kernel
139s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
20/06/2024, 03:29

Target
026c666fec4462481443216717fe2208_JaffaCakes118.dll
Size 90KB
Sample240620-d2dnka1bml
SHA256 fdaa27b5053b6ac0b3b0600f377725ca006072b2a32239667e54a0083e7e94f0
MD5 026c666fec4462481443216717fe2208
SHA1 2b133020160fba299a58d248d16c755ff34c5da1
SHA512 925bd68472037c40371a1a5d0597f49e6ffa1fa3da8f74f15b51bf7e9dcf695c04ecc9b4415ebc6513a916ca34caa175764debac04f78a8f6858ec12e1e1bab8
SSDEEP 1536:TXYvynn+A2VKzuOfRigcTGL/9p3xxWhAH/47u5F3bH5tX/zEdCKliCLpp0HKrZcy:sv4+A9zz50GLDv/fXLr5JYdCKQibx
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3952 wrote to memory of 1856	3952	regsvr32.exe	83
PID 3952 wrote to memory of 1856	3952	regsvr32.exe	83
PID 3952 wrote to memory of 1856	3952	regsvr32.exe	83

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\026c666fec4462481443216717fe2208_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3952
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\026c666fec4462481443216717fe2208_JaffaCakes118.dll
  2⤵
  PID:1856