c5c79121bcce79c8fc0a1902b59f1a525dd046c29922509f181b785993834a3b

Analysis

max time kernel
148s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
08/07/2024, 16:44

Target

2d13a90714e99dafde5e1043efee607c_JaffaCakes118.dll
Size

192KB
MD5

2d13a90714e99dafde5e1043efee607c
SHA1

7d0d81e4241719bb0f624eb16591fc60d171f5b3
SHA256

c5c79121bcce79c8fc0a1902b59f1a525dd046c29922509f181b785993834a3b
SHA512

b68dcb40338774bc4448564ba6750f3b7f44d0bf4e5e471fc2d8e457eb892841795107f08d1dc8ed8929100e632f680c2581ddcb015b0a3900bfb980505c9afc
SSDEEP

3072:zlmz+UvTl4IIKr8HBmYr74bwTtaoAa/oOgoD4cjAsD17pZVEUpA++56QRXa:zeraFE+tCOgUnvR+J

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3344 wrote to memory of 1188	3344	regsvr32.exe	83
PID 3344 wrote to memory of 1188	3344	regsvr32.exe	83
PID 3344 wrote to memory of 1188	3344	regsvr32.exe	83

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\2d13a90714e99dafde5e1043efee607c_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3344
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\2d13a90714e99dafde5e1043efee607c_JaffaCakes118.dll
  2⤵
  PID:1188