c5589bb282f14c6d5a443ddb50f8931a7cec9b4eab0c4efbc636984c39a8b81c

Analysis

max time kernel
94s
max time network
102s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
09/07/2024, 01:23

Target

2e84c56cd9fb4f96264e4eb63cbe445a_JaffaCakes118.dll
Size

80KB
MD5

2e84c56cd9fb4f96264e4eb63cbe445a
SHA1

3d8efda0825de5486835a97b0aede973c6296930
SHA256

c5589bb282f14c6d5a443ddb50f8931a7cec9b4eab0c4efbc636984c39a8b81c
SHA512

5d090c66586801c6d37613400a87368edbb00f3307725b54ad98fd098be3aabb8fd393009894f5f21683c836d6450eff109cb7d4c8444e456813bbfd2b7882de
SSDEEP

1536:bNqDQpy4BtEznCTS0/sti0onyZGOxI2s0ciXjK3mgfEzYTmeB8cW+tbueorU4Kj4:mCy47EIScKSy/xvs0cizK3mgfXzB8cT8

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2456 wrote to memory of 4940	2456	regsvr32.exe	82
PID 2456 wrote to memory of 4940	2456	regsvr32.exe	82
PID 2456 wrote to memory of 4940	2456	regsvr32.exe	82

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\2e84c56cd9fb4f96264e4eb63cbe445a_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2456
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\2e84c56cd9fb4f96264e4eb63cbe445a_JaffaCakes118.dll
  2⤵
  PID:4940