e59ee74c6773410700521d7d60ebce7017b086e0f438daf1612403b9adf80264

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
16/07/2024, 00:55

Target

4c26a5158c8fd7d4a44486404de41e09_JaffaCakes118.dll
Size

2.1MB
MD5

4c26a5158c8fd7d4a44486404de41e09
SHA1

8340700b72e76910fc715fb069581c4984e5829f
SHA256

e59ee74c6773410700521d7d60ebce7017b086e0f438daf1612403b9adf80264
SHA512

6826d6fdb29d4d630be9d92fa967bcedc33861fbbebd8df67f7065a293a737f877e3addca8acef6a1c98cdbc893752c6d8f7bf3210ba50eb7b1be4ad29239f7f
SSDEEP

49152:+IsZgmtfiBTkMHKvEQzsIuqh14hYSTYQ22Q:+qCQHKvECsIL1UC

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4896 wrote to memory of 4348	4896	regsvr32.exe	83
PID 4896 wrote to memory of 4348	4896	regsvr32.exe	83
PID 4896 wrote to memory of 4348	4896	regsvr32.exe	83

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\4c26a5158c8fd7d4a44486404de41e09_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4896
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\4c26a5158c8fd7d4a44486404de41e09_JaffaCakes118.dll
  2⤵
  PID:4348