399d01e43204c92568b93b93b0ac8c427f722d4773ab43b2a758ce7e45ff16fd

Analysis

max time kernel
144s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
10/07/2024, 19:33

Target

3616ed14bf7c87b0903066041bb3fc5d_JaffaCakes118.dll
Size

137KB
MD5

3616ed14bf7c87b0903066041bb3fc5d
SHA1

d57390153670191c22cd7f0fcf1acb697fc34cf7
SHA256

399d01e43204c92568b93b93b0ac8c427f722d4773ab43b2a758ce7e45ff16fd
SHA512

6833a61f4134038f59fb7f7829ee7cd3c62de3e7b8805c29b9edfc7e785ce49eb2448e89d211c88fa9c4c5edbdffdac38def833eed5562f1ce7eb69ab8aeb208
SSDEEP

3072:2va6tOSk4eJw6BBO/ku0pBTNBoJ5Pn2+mfyGlgH:QPAd4uJTuOPae+nH

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4800 wrote to memory of 1000	4800	regsvr32.exe	83
PID 4800 wrote to memory of 1000	4800	regsvr32.exe	83
PID 4800 wrote to memory of 1000	4800	regsvr32.exe	83

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\3616ed14bf7c87b0903066041bb3fc5d_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4800
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\3616ed14bf7c87b0903066041bb3fc5d_JaffaCakes118.dll
  2⤵
  PID:1000