c59e7f0425f3160307d3fc71315a78d7143e16c6e7b93cee1ccf91f00e16bb7b

Analysis

max time kernel
94s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
11/07/2024, 00:40

Target

370d8991d00b742aa7ab55108fd13ca6_JaffaCakes118.dll
Size

234KB
MD5

370d8991d00b742aa7ab55108fd13ca6
SHA1

6f5f6f18a6c0096f95af9d2ff5084e0aaec18609
SHA256

c59e7f0425f3160307d3fc71315a78d7143e16c6e7b93cee1ccf91f00e16bb7b
SHA512

e2709d7c3112d8622a0324b36e8d47fb4c1001d19aeb925c8f6f2367006b17a55fc9d93fd1f7c4fc856e9c81aefcaadaf167bdc5659e221da0b1f79e1ef5c745
SSDEEP

6144:NWa74XgWa74XgWa74XgWa74XgWa74XgWa74XgWa74X:NWaEgWaEgWaEgWaEgWaEgWaEgWaE

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3180 wrote to memory of 1900	3180	regsvr32.exe	83
PID 3180 wrote to memory of 1900	3180	regsvr32.exe	83
PID 3180 wrote to memory of 1900	3180	regsvr32.exe	83

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\370d8991d00b742aa7ab55108fd13ca6_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3180
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\370d8991d00b742aa7ab55108fd13ca6_JaffaCakes118.dll
  2⤵
  PID:1900