29769d04d492b5e7022afc2ba7af9f487d3ce2f9b164b1a189c389a42b77995f

Analysis

max time kernel
139s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
24/06/2024, 10:54

Target
0819680f9633ccc846b3776cbc382bad_JaffaCakes118.dll
Size 64KB
Sample240624-mzst5ssbpp
SHA256 29769d04d492b5e7022afc2ba7af9f487d3ce2f9b164b1a189c389a42b77995f
MD5 0819680f9633ccc846b3776cbc382bad
SHA1 93480c5c4d6c78b40df8b02aedf1fea4537a4b0d
SHA512 1abd9a4b75ee808b40a523bafd27b1c8134c68d59d1c66d251ccd7ad667a3b861100352b9c49f3f91fc01fce2aeffa9ba355b776351f31b350bfb28f6b270c03
SSDEEP 768:GTQ4Ghajq27LWlRJl/ny+0083sOWXezr5PqZwkk/aPi0C7FupuuBmIu:W0gZfwRPyhsMPqZFVCIFBmIu
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1892 wrote to memory of 4196	1892	regsvr32.exe	83
PID 1892 wrote to memory of 4196	1892	regsvr32.exe	83
PID 1892 wrote to memory of 4196	1892	regsvr32.exe	83

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\0819680f9633ccc846b3776cbc382bad_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1892
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\0819680f9633ccc846b3776cbc382bad_JaffaCakes118.dll
  2⤵
  PID:4196