09b0020ee179aa8c80a203c93ace8b6610f532247833d4ac12d1c0abd632d5d6

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
20-06-2024 14:18

Target

06c10ec61c7c16c469d6982dc548fe63_JaffaCakes118.dll
Size

47KB
MD5

06c10ec61c7c16c469d6982dc548fe63
SHA1

153d5c104a6e00e1bfdbb6338fc5db4e7ea959a6
SHA256

09b0020ee179aa8c80a203c93ace8b6610f532247833d4ac12d1c0abd632d5d6
SHA512

0c86ae5fc9d5a34e6090ea1ac8a24c459395af50da04b87ff23ebc2fe4b8c870f7c57ab2f069d7ad730f43877c3ea8410c6f57088d6775d9217acf6b66e9d704
SSDEEP

768:MSVMqQCVaQkUwjWnoGw/Z2+KhniiO5OpBlw1qSRRLfuy/oDY2wrRjxOHgQjv:rVMqFVaQbo/Z2hniiGOpBlwvo4PZQjv

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3840 wrote to memory of 1900	3840	regsvr32.exe	85
PID 3840 wrote to memory of 1900	3840	regsvr32.exe	85
PID 3840 wrote to memory of 1900	3840	regsvr32.exe	85

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\06c10ec61c7c16c469d6982dc548fe63_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3840
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\06c10ec61c7c16c469d6982dc548fe63_JaffaCakes118.dll
  2⤵
  PID:1900