05777e177fc4acca2d8347f7aa7b2ea0e17d4837501c17e464e208228a09b2c4

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
06-07-2024 21:11

Target

295f06d92f4107f271ed7061f3aaeaf7_JaffaCakes118.dll
Size

29KB
MD5

295f06d92f4107f271ed7061f3aaeaf7
SHA1

0e984ab75ba213de12091a620b1795e44f66680c
SHA256

05777e177fc4acca2d8347f7aa7b2ea0e17d4837501c17e464e208228a09b2c4
SHA512

32ba4d88ac393a3ff8771dd989c0dd7a54945599df09ff3ee2da9c417670390839feee0688633bdddae5c98bb24fc5a08a3e7f6d38e5d7e67da613f4adde46a7
SSDEEP

384:30AHxUSCqujBwKnGQ6VIE4R4fKCUYyxb4REGbMP5KriKMCqZzAzdRNQMJXvkC4z5:lKSCquFw0GQu2R4fpbMxSiGldRNdB+5

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1968 wrote to memory of 3684	1968	regsvr32.exe	82
PID 1968 wrote to memory of 3684	1968	regsvr32.exe	82
PID 1968 wrote to memory of 3684	1968	regsvr32.exe	82

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\295f06d92f4107f271ed7061f3aaeaf7_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1968
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\295f06d92f4107f271ed7061f3aaeaf7_JaffaCakes118.dll
  2⤵
  PID:3684