0722f03d70b88daa4f161115d5a43e713c60daafb697904175330e0f4d730e9e

Analysis

max time kernel
51s
max time network
53s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
20/06/2024, 05:47

Target

035b2813315cddf971e40402ff8ec402_JaffaCakes118.dll
Size

47KB
MD5

035b2813315cddf971e40402ff8ec402
SHA1

34c62607b449d91e97d61b14f218c0c71e157dc1
SHA256

0722f03d70b88daa4f161115d5a43e713c60daafb697904175330e0f4d730e9e
SHA512

8b1ad50bf534c2478984df3e7964a85a33c5131edab220d86658e39f65286887e357ba520f98fedf09f858476114e6c77e4f13486121a3c35ac8ac0fb838add6
SSDEEP

768:sSVMqQCVaQkUwjWnof6hi9k9iO5OpBlRT4zud/JBKV4ZPZISgI4xOHYQngrm:LVMqFVaQbo6hik9iGOpBlRTFnruSgBQ3

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3152 wrote to memory of 3908	3152	regsvr32.exe	81
PID 3152 wrote to memory of 3908	3152	regsvr32.exe	81
PID 3152 wrote to memory of 3908	3152	regsvr32.exe	81

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\035b2813315cddf971e40402ff8ec402_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3152
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\035b2813315cddf971e40402ff8ec402_JaffaCakes118.dll
  2⤵
  PID:3908