d49631f2f407027af16c22100c139f132f0bb84f6c4316e6aa8465953de6f1a7

Analysis

max time kernel
51s
max time network
51s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
21/06/2024, 14:07

Target
0c1f0270c1f1af4c429b3425cb32828a_JaffaCakes118.dll
Size 48KB
Sample240621-re4hcsshjg
SHA256 d49631f2f407027af16c22100c139f132f0bb84f6c4316e6aa8465953de6f1a7
MD5 0c1f0270c1f1af4c429b3425cb32828a
SHA1 942b85ede659364a8cc60a6020269ba215761673
SHA512 1f7b29d22df4ef6c8c991d0fd78ef31d820efda49d4f84e4041797ce4f8113ba71eccdee5457fdf89b8d6b8b96774d48c0871894ba5257e24ee3b117b4257cfd
SSDEEP 768:6mpM8NHn9/NyvOSj71F3Wl31TCU2txOwV8JtFqidNbh3Rc3iN:6aLf4Oi1F3PtAFJtFd5N
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4864 wrote to memory of 4316	4864	regsvr32.exe	81
PID 4864 wrote to memory of 4316	4864	regsvr32.exe	81
PID 4864 wrote to memory of 4316	4864	regsvr32.exe	81

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\0c1f0270c1f1af4c429b3425cb32828a_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4864
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\0c1f0270c1f1af4c429b3425cb32828a_JaffaCakes118.dll
  2⤵
  PID:4316