bdd484631765b424276a42d2e5d3e2a0ef8a51e39a487d9249ba3ccef5a5ef78

Analysis

max time kernel
135s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
20/06/2024, 15:36

Target

0758a7fbe70746c53814f3cdad9a199f_JaffaCakes118.dll
Size

29KB
MD5

0758a7fbe70746c53814f3cdad9a199f
SHA1

45ac50222733406ebc01af78a3b4cbbd45b2bd61
SHA256

bdd484631765b424276a42d2e5d3e2a0ef8a51e39a487d9249ba3ccef5a5ef78
SHA512

ffd71af8ae7e7a38f51184cc707a52cc67691fd5c319baa24c4dd6b224e4146d6c41b772f4db0c43ecb287a57c6df2561706d256ae12fd6ffb308ebc9d39540b
SSDEEP

768:HKSqquxD0GQjgRJMeBLEwzGx7pnnfs46dhG9ie:9qquxD0GQSPBLvaLmE9

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3364 wrote to memory of 2660	3364	regsvr32.exe	82
PID 3364 wrote to memory of 2660	3364	regsvr32.exe	82
PID 3364 wrote to memory of 2660	3364	regsvr32.exe	82

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\0758a7fbe70746c53814f3cdad9a199f_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3364
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\0758a7fbe70746c53814f3cdad9a199f_JaffaCakes118.dll
  2⤵
  PID:2660