ca16866859a596365f455afda569a99bc817cee2952c00b8ae4377b71e4f7ef6

Analysis

max time kernel
54s
max time network
67s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03/07/2024, 02:31

Target

20c7abe34014b021b0fecb7a8fc8e57c_JaffaCakes118.dll
Size

93KB
MD5

20c7abe34014b021b0fecb7a8fc8e57c
SHA1

12b35d91f2910af9a7a9ef9629cd068d7acbb180
SHA256

ca16866859a596365f455afda569a99bc817cee2952c00b8ae4377b71e4f7ef6
SHA512

7b5d8ab4b58baefe99f17c9dddf17f3808e98677e4a51168bcfcdab4615890e04849f434bdcb0b6de62fdce0ddf89a5ea6e8e063efff9411fa617075c4ad4ebe
SSDEEP

768:9eP9h30L3nxMi5POoU29JbRAeP9h30L3nxMi5POoU29JbRAeP9h30L3nxMi5POoZ:9kfwMi5GkfwMi5GkfwMi5

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3948 wrote to memory of 4544	3948	regsvr32.exe	83
PID 3948 wrote to memory of 4544	3948	regsvr32.exe	83
PID 3948 wrote to memory of 4544	3948	regsvr32.exe	83

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\20c7abe34014b021b0fecb7a8fc8e57c_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3948
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\20c7abe34014b021b0fecb7a8fc8e57c_JaffaCakes118.dll
  2⤵
  PID:4544