0bf850e64b031147ebe7e68085833129bc3179eca034c041a528e403a527a4b6

Analysis

max time kernel
139s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
20/07/2024, 22:48

Target

604b863391c3f62b901b379edb190aed_JaffaCakes118.dll
Size

193KB
MD5

604b863391c3f62b901b379edb190aed
SHA1

f9e91c7a6c542140753763ffb9a4c8bd01eb12a8
SHA256

0bf850e64b031147ebe7e68085833129bc3179eca034c041a528e403a527a4b6
SHA512

d30cad3516dcb67bc66eb57ecce0cf6ed9742d6f35b79ad89285627072a5a0afa1cc89f6ca6a98112a95d224cb2948a202daa928a43b103e7eea11f071657416
SSDEEP

3072:DVCIZa+/3ncvv9TFqwddin7NWL+8UWBoMS3OgppjPPA:Do4x3fwddinsLkpMS3Ogp2

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2604 wrote to memory of 2680	2604	regsvr32.exe	86
PID 2604 wrote to memory of 2680	2604	regsvr32.exe	86
PID 2604 wrote to memory of 2680	2604	regsvr32.exe	86

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\604b863391c3f62b901b379edb190aed_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2604
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\604b863391c3f62b901b379edb190aed_JaffaCakes118.dll
  2⤵
  PID:2680