2ae3faa50b9045df3ba2f91f9cc83fcaead2a542828dfde8fe16370fac9b28bd

Analysis

max time kernel
32s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
16/07/2024, 05:34

Target

4cffb1c1ab7896cf4aa2963fa1004919_JaffaCakes118.dll
Size

108KB
MD5

4cffb1c1ab7896cf4aa2963fa1004919
SHA1

fa515abe109f829e2f9d87e04d83a50a23b8a4b9
SHA256

2ae3faa50b9045df3ba2f91f9cc83fcaead2a542828dfde8fe16370fac9b28bd
SHA512

8463b76babc9a4f813ef71aed2f708705d26d5f9bc33bce27596d8b33314d5955500acbd3342021e95f9de5f040ecc431bdfd37508ea9384183e4526bca42d57
SSDEEP

1536:xwPm9pJN4Mk+SbeDd4JFmX2TuQ+fuBrzu65:OmTzO+S6KHTuD2B/u65

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4432 wrote to memory of 4868	4432	regsvr32.exe	82
PID 4432 wrote to memory of 4868	4432	regsvr32.exe	82
PID 4432 wrote to memory of 4868	4432	regsvr32.exe	82

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\4cffb1c1ab7896cf4aa2963fa1004919_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4432
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\4cffb1c1ab7896cf4aa2963fa1004919_JaffaCakes118.dll
  2⤵
  PID:4868