d8e0176f870e679c4b296a7b5dae49921a460b59d3b3e261e76b61f2d88620d5

Analysis

max time kernel
141s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
22-07-2024 17:35

Target

64204614037aa0378976491789618400_JaffaCakes118.dll
Size

220KB
MD5

64204614037aa0378976491789618400
SHA1

86a0365704921d0a944f76b2bd5ef000e27056db
SHA256

d8e0176f870e679c4b296a7b5dae49921a460b59d3b3e261e76b61f2d88620d5
SHA512

76c35a061d1801e43f02caa5b5df7b09cf097fef32e07e2b9fa8ae4bc9c99bd276045fee7bba98e51cf30b4fcf92394bb5cf007ad8e065c7511ece191e6e65fe
SSDEEP

1536:pkfZ+l7oGWnM6zkfZ+l7oGWnM6zkfZ+l7oGWnM6zkfZ+l7oGWnM6zkfZ+l7oGWnD:qGW/EGW/EGW/EGW/EGW/EGW/EGW/

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3548 wrote to memory of 3428	3548	regsvr32.exe	84
PID 3548 wrote to memory of 3428	3548	regsvr32.exe	84
PID 3548 wrote to memory of 3428	3548	regsvr32.exe	84

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\64204614037aa0378976491789618400_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3548
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\64204614037aa0378976491789618400_JaffaCakes118.dll
  2⤵
  PID:3428