e689490cf9b3b38f7d61cfc8b35e3dae0ba020aff1e3629227cc83415c3b8789

Analysis

max time kernel
138s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
23/07/2024, 09:32

Target

6707dec20ba07a373463c0fc27f219bb_JaffaCakes118.dll
Size

220KB
MD5

6707dec20ba07a373463c0fc27f219bb
SHA1

860a0d363ef27e0bbd9ce3850622f762b3f03106
SHA256

e689490cf9b3b38f7d61cfc8b35e3dae0ba020aff1e3629227cc83415c3b8789
SHA512

aaed786831d8816b88622a82835cc9a7ce06ba44b9efbce43dca568dada0fd66d7b26dacd91143eb0150aac510266195df9c5148d779e636b8495f33568afc6f
SSDEEP

1536:+2h3qUVJWM2h3qUVJWM2h3qUVJWM2h3qUVJWM2h3qUVJWM2h3qUVJWM2h3qUVJW:KwJWowJWowJWowJWowJWowJWowJW

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4512 wrote to memory of 4184	4512	regsvr32.exe	84
PID 4512 wrote to memory of 4184	4512	regsvr32.exe	84
PID 4512 wrote to memory of 4184	4512	regsvr32.exe	84

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\6707dec20ba07a373463c0fc27f219bb_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4512
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\6707dec20ba07a373463c0fc27f219bb_JaffaCakes118.dll
  2⤵
  PID:4184