d974427a86895cd3e4190d6c6c6e6d8032b1dd25be8ae251931b2cfba595229c

Analysis

max time kernel
93s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
24/06/2024, 00:49

Target

05f44ef827b6b8cf29631018245c5b5c_JaffaCakes118.dll
Size

80KB
MD5

05f44ef827b6b8cf29631018245c5b5c
SHA1

c2230889e7e181931b57960db9076f39a6eb152c
SHA256

d974427a86895cd3e4190d6c6c6e6d8032b1dd25be8ae251931b2cfba595229c
SHA512

5c6b00ffdfa56981ec305ccbdb0e41dfefdc95f68b8dab93300c09cf69036039c0ab7e95bbac3d431adcd970c4810bbeb2dcba535a3079d98c21312fdf2e0da5
SSDEEP

1536:HaWuPNJU3aiHCj/PtfNAXEm7V1m29evV5KonJpDvRCZgJFp:PuPboatAEm229aHKeJp7R42T

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 892 wrote to memory of 4392	892	regsvr32.exe	81
PID 892 wrote to memory of 4392	892	regsvr32.exe	81
PID 892 wrote to memory of 4392	892	regsvr32.exe	81

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\05f44ef827b6b8cf29631018245c5b5c_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:892
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\05f44ef827b6b8cf29631018245c5b5c_JaffaCakes118.dll
  2⤵
  PID:4392