085cb78bcab323930eb5b0a70d2b896bbfbc54d91786f19abf3db73d4c83b9b3

Analysis

max time kernel
143s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
21/07/2024, 18:15

Target

60e802ed3f5ed0ee84c4c2cc5eda38da_JaffaCakes118.dll
Size

121KB
MD5

60e802ed3f5ed0ee84c4c2cc5eda38da
SHA1

db1963746c18c5ab5ee6d1c41eebefa40f6ceca9
SHA256

085cb78bcab323930eb5b0a70d2b896bbfbc54d91786f19abf3db73d4c83b9b3
SHA512

9bbcd679c92cac0fa4c33b517ec6f607520530f75a52ac5ab4ed605b63c76032f5c1ef627c1c9644f9eb401a5d8c6cc485cbe6d6f5b846c617ac6d07fe87001d
SSDEEP

3072:OOUHvT36Rpgsa4THC0+lrw71ldCQ7Sp6L35642iM:4HvT6MsFHGlM7FCsSp+5647

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3692 wrote to memory of 3376	3692	regsvr32.exe	84
PID 3692 wrote to memory of 3376	3692	regsvr32.exe	84
PID 3692 wrote to memory of 3376	3692	regsvr32.exe	84

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\60e802ed3f5ed0ee84c4c2cc5eda38da_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3692
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\60e802ed3f5ed0ee84c4c2cc5eda38da_JaffaCakes118.dll
  2⤵
  PID:3376