fd0f63b21ce70db00e332db4ae095db522418f2e0464ab18657f8e87e3170a80

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
09/07/2024, 20:52

Target

31efb5880b0042adfb83dc8cb7e3611e_JaffaCakes118.dll
Size

351KB
MD5

31efb5880b0042adfb83dc8cb7e3611e
SHA1

b2f630ed985683c3115d8159f012497c1f4d6cfa
SHA256

fd0f63b21ce70db00e332db4ae095db522418f2e0464ab18657f8e87e3170a80
SHA512

8d95b8b93d2992cd34b80bbda27eee60dc78e5fca71cd4adfa1f25a54d4408998a7f29932895e0720eead2c6f9b3dbd923c0da372d0ff5d76dd83829f0f053f6
SSDEEP

6144:KcfLlCOjRsKKcsQu7tcb/d6wTcVpto0A8UKrNuJJXFt+gXx+YEB4s6m:KcfLlCuBR/d9okQrwJpFt9oYEB

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4828 wrote to memory of 2580	4828	regsvr32.exe	80
PID 4828 wrote to memory of 2580	4828	regsvr32.exe	80
PID 4828 wrote to memory of 2580	4828	regsvr32.exe	80

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\31efb5880b0042adfb83dc8cb7e3611e_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4828
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\31efb5880b0042adfb83dc8cb7e3611e_JaffaCakes118.dll
  2⤵
  PID:2580