0d952445bedb2b5fcdc14105f31aa4322b5f0284c33e3cfe871cf789a1515fef

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
14/07/2024, 08:50

Target

451dee7d1344de2071287178caf4f7f7_JaffaCakes118.dll
Size

30KB
MD5

451dee7d1344de2071287178caf4f7f7
SHA1

519641dadd285f455ff2a5ba1b85ede9f28f72da
SHA256

0d952445bedb2b5fcdc14105f31aa4322b5f0284c33e3cfe871cf789a1515fef
SHA512

08335113a5ec0ba6b7ba37b98360a7de169fc6e992575d5266ec5075cf73473e7a7d0a7cae13a067c7719529793595fbb5d5de44b5b5ac79b513abcbc814c376
SSDEEP

384:K59+PbhI7kZp9W/ACSrRqA2BKg31GztPnuGy1gjM38HxAw09qbs8sIHvB0N5B:y+ThI7G/hv2IBPuG8gjrJ09Sswvm

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 828 wrote to memory of 5056	828	regsvr32.exe	83
PID 828 wrote to memory of 5056	828	regsvr32.exe	83
PID 828 wrote to memory of 5056	828	regsvr32.exe	83

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\451dee7d1344de2071287178caf4f7f7_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:828
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\451dee7d1344de2071287178caf4f7f7_JaffaCakes118.dll
  2⤵
  PID:5056