8c6d0c9a36191a94c3bc8e8d21b10d61a8f8027da24f5950dd90e9f0204c8650

Analysis

max time kernel
94s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
14/07/2024, 11:38

Target

45a72f0b823f99dee530f5ff9a4ac01b_JaffaCakes118.dll
Size

120KB
MD5

45a72f0b823f99dee530f5ff9a4ac01b
SHA1

1369c03f0e0779839bd2e1907dcc8730a7a141f8
SHA256

8c6d0c9a36191a94c3bc8e8d21b10d61a8f8027da24f5950dd90e9f0204c8650
SHA512

797547b4ae6c58a0177be9052d259f36d1140b9c159235d2074e13204540c2b2a6cdb6a604d21d92e29bd5c7c189b7b1c9bdc2209bd5d761c187b7fe09fecffa
SSDEEP

3072:EwSbYrbSWaU7q/9YU09VmifK7W4flzN3EqpjiqFepyO:pXmU8p06ZN3gqF

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3152 wrote to memory of 3544	3152	regsvr32.exe	83
PID 3152 wrote to memory of 3544	3152	regsvr32.exe	83
PID 3152 wrote to memory of 3544	3152	regsvr32.exe	83

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\45a72f0b823f99dee530f5ff9a4ac01b_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3152
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\45a72f0b823f99dee530f5ff9a4ac01b_JaffaCakes118.dll
  2⤵
  PID:3544