5295cca623dd4ece091e8a4c127bc4a5d608b399a84efa027dce733f2a9e27ad

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
16-07-2024 04:04

Target

4cbc635e263401692916c677c9b3eb18_JaffaCakes118.dll
Size

400KB
MD5

4cbc635e263401692916c677c9b3eb18
SHA1

48bb51629514497a8b57b1175e7066d056622b0e
SHA256

5295cca623dd4ece091e8a4c127bc4a5d608b399a84efa027dce733f2a9e27ad
SHA512

37b3e94fbadae6766b9a4dbddad9e8f4dbf9cf3f9baf6baa603f724ee7699f802b865c03017a007593e857824519d5fa00330b32afccec9dcdf5a81e4f024666
SSDEEP

12288:sC3aGYUQ6gUSwcNA3OuMVqN6DZh/wi0NFG3H:sC3/Y8SSV6Dn/z0YH

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4124 wrote to memory of 4408	4124	regsvr32.exe	83
PID 4124 wrote to memory of 4408	4124	regsvr32.exe	83
PID 4124 wrote to memory of 4408	4124	regsvr32.exe	83

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\4cbc635e263401692916c677c9b3eb18_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4124
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\4cbc635e263401692916c677c9b3eb18_JaffaCakes118.dll
  2⤵
  PID:4408