bdfab873e18e01d2cb561697e4a37a2907ee56d8370fed447e72eb0e0d9004d2

Analysis

max time kernel
51s
max time network
51s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
20/06/2024, 08:27

Target

0456eaf844380e6c8fe54cdb7cde310a_JaffaCakes118.dll
Size

29KB
MD5

0456eaf844380e6c8fe54cdb7cde310a
SHA1

e2ca873bbd3762096b42bc40f98442534bc18bb6
SHA256

bdfab873e18e01d2cb561697e4a37a2907ee56d8370fed447e72eb0e0d9004d2
SHA512

9fbd524c467fbeb7efe937927a4ce50d34c915319a2e0806ba487e83be0f1a18b053bdd736032c9f491f76ddc145e75c1953122cdf4355cc097d478df536b86e
SSDEEP

768:wKSRCquPr0GQAQRCp6b8eKZDojtU1XfZE+wHdKwX7+A:QoquPr0GQ845aktefqd9D+

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1580 wrote to memory of 2248	1580	regsvr32.exe	83
PID 1580 wrote to memory of 2248	1580	regsvr32.exe	83
PID 1580 wrote to memory of 2248	1580	regsvr32.exe	83

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\0456eaf844380e6c8fe54cdb7cde310a_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1580
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\0456eaf844380e6c8fe54cdb7cde310a_JaffaCakes118.dll
  2⤵
  PID:2248