93dfb08877368c97d65bbeeff3493239d08e4623e891708e99a84d5544ff5e21

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
20/06/2024, 09:58

Target

04f381dc58deac4b12e6a2d26f40f7db_JaffaCakes118.dll
Size

140KB
MD5

04f381dc58deac4b12e6a2d26f40f7db
SHA1

686430f5eebe526dbcfee0f334e9410c7205c30f
SHA256

93dfb08877368c97d65bbeeff3493239d08e4623e891708e99a84d5544ff5e21
SHA512

7f3abd9d60f3f0cdcd9f5cbad4d55a0817d84b1ca5c32ac555fbdd33cebb17d937e015a956931cf41562ef4bef7a893305008c7534e62c1e1a138f5410f1fde3
SSDEEP

3072:D4YJTiKo6b81fu0l20Q7XzQ8u+kJipMMl:DTJTmC82vPQ1+XpVl

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3752 wrote to memory of 3392	3752	regsvr32.exe	82
PID 3752 wrote to memory of 3392	3752	regsvr32.exe	82
PID 3752 wrote to memory of 3392	3752	regsvr32.exe	82

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\04f381dc58deac4b12e6a2d26f40f7db_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3752
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\04f381dc58deac4b12e6a2d26f40f7db_JaffaCakes118.dll
  2⤵
  PID:3392