a23af2cd0f9c67e1543251b509ffa3618321f3c524c57eb2f0ea971ec6565989

Analysis

max time kernel
93s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
10/07/2024, 03:52

Target

3333a57b12adb60a03b706d34beb8f7b_JaffaCakes118.dll
Size

33KB
MD5

3333a57b12adb60a03b706d34beb8f7b
SHA1

9b1eac9935997dcc89e0bb5658847bc2171bfb58
SHA256

a23af2cd0f9c67e1543251b509ffa3618321f3c524c57eb2f0ea971ec6565989
SHA512

66c6c1a63689e01f0007f89ecf3914c54f1b04b51e595105f25d1345b414ccd303ba4ba0867356e00a0246cfc3e2bb9414cd0e16c6213b985515a466f7ba728e
SSDEEP

768:T+v9hxFUPcYmFXwuELKFZMj2DbVWk4pfwiOMkS:TE/xePcYeXw0MKVh6NkS

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2376 wrote to memory of 2260	2376	regsvr32.exe	81
PID 2376 wrote to memory of 2260	2376	regsvr32.exe	81
PID 2376 wrote to memory of 2260	2376	regsvr32.exe	81

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\3333a57b12adb60a03b706d34beb8f7b_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2376
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\3333a57b12adb60a03b706d34beb8f7b_JaffaCakes118.dll
  2⤵
  PID:2260