29769d04d492b5e7022afc2ba7af9f487d3ce2f9b164b1a189c389a42b77995f

Analysis

max time kernel
139s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
24/06/2024, 10:54

Target

0819680f9633ccc846b3776cbc382bad_JaffaCakes118.dll
Size

64KB
MD5

0819680f9633ccc846b3776cbc382bad
SHA1

93480c5c4d6c78b40df8b02aedf1fea4537a4b0d
SHA256

29769d04d492b5e7022afc2ba7af9f487d3ce2f9b164b1a189c389a42b77995f
SHA512

1abd9a4b75ee808b40a523bafd27b1c8134c68d59d1c66d251ccd7ad667a3b861100352b9c49f3f91fc01fce2aeffa9ba355b776351f31b350bfb28f6b270c03
SSDEEP

768:GTQ4Ghajq27LWlRJl/ny+0083sOWXezr5PqZwkk/aPi0C7FupuuBmIu:W0gZfwRPyhsMPqZFVCIFBmIu

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1892 wrote to memory of 4196	1892	regsvr32.exe	83
PID 1892 wrote to memory of 4196	1892	regsvr32.exe	83
PID 1892 wrote to memory of 4196	1892	regsvr32.exe	83

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\0819680f9633ccc846b3776cbc382bad_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1892
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\0819680f9633ccc846b3776cbc382bad_JaffaCakes118.dll
  2⤵
  PID:4196