fb2e9ae636318af9223bed23400d7531e2ab2d23f91f448669c2d7ec5a4170ce

Analysis

max time kernel
147s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
20/06/2024, 18:12

Target

0888944d096001de1824aab9f2f04fec_JaffaCakes118.dll
Size

48KB
MD5

0888944d096001de1824aab9f2f04fec
SHA1

487428cd5233bd11897c96e947e9abd8eccc6193
SHA256

fb2e9ae636318af9223bed23400d7531e2ab2d23f91f448669c2d7ec5a4170ce
SHA512

80c7ad2b6eae7f1cde82be7f25e29099e50ad56391b84e4e2ea5b7dd3c0c5f1c6485b8e9723008c120a4de6ffe32e071879d96d8dab5aed99930fa202f8df8b6
SSDEEP

768:OmpM8V/5Q1GuorDx8UBuwiHCjMATj/78rIhYZJWM4R12gxvcDxOHONR+:OajG6V8aiHCj/TjGWM4R12g+fNR+

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 428 wrote to memory of 4404	428	regsvr32.exe	82
PID 428 wrote to memory of 4404	428	regsvr32.exe	82
PID 428 wrote to memory of 4404	428	regsvr32.exe	82

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\0888944d096001de1824aab9f2f04fec_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:428
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\0888944d096001de1824aab9f2f04fec_JaffaCakes118.dll
  2⤵
  PID:4404