bd1285aef374b343e6fa66a13aba8bfa96b9221f478f7f7cf49deb148b92db69

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
06/04/2024, 12:14

Target

e2855c9cb8354aef0961dce7680a8040_JaffaCakes118.dll
Size

100KB
MD5

e2855c9cb8354aef0961dce7680a8040
SHA1

a4da12568462e6307aced728d0ee1ec4c1884357
SHA256

bd1285aef374b343e6fa66a13aba8bfa96b9221f478f7f7cf49deb148b92db69
SHA512

47018cf9b141d81bf524f7c7391648e77577343d786c4ef73b107e3a1839979526588f9dc1bf98d90a31a09e126ef0e7d1e687427923fd1b312b8b79ac59c23a
SSDEEP

3072:/Z6Vyan9b5rKYWjTcR0Sds17BcoD7cnbR/V8:4Jnx5Kjo0BooDQnbd

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2228 wrote to memory of 2500	2228	regsvr32.exe	28
PID 2228 wrote to memory of 2500	2228	regsvr32.exe	28
PID 2228 wrote to memory of 2500	2228	regsvr32.exe	28
PID 2228 wrote to memory of 2500	2228	regsvr32.exe	28
PID 2228 wrote to memory of 2500	2228	regsvr32.exe	28
PID 2228 wrote to memory of 2500	2228	regsvr32.exe	28
PID 2228 wrote to memory of 2500	2228	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\e2855c9cb8354aef0961dce7680a8040_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2228
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\e2855c9cb8354aef0961dce7680a8040_JaffaCakes118.dll
  2⤵
  PID:2500

memory/2500-0-0x0000000000190000-0x00000000001D6000-memory.dmp

Filesize
280KB

Download