778788aad8c5cac6b15ce98468bf37d15dcf4b7d700cf94725c5f05fae1a5d4b

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
08-04-2024 18:23

Target

e81dbe9d2ffaaf5b40b74cc6b5ba3fd5_JaffaCakes118.dll
Size

81KB
MD5

e81dbe9d2ffaaf5b40b74cc6b5ba3fd5
SHA1

b21b57064a401acc75ac245eb88ced2d734d5781
SHA256

778788aad8c5cac6b15ce98468bf37d15dcf4b7d700cf94725c5f05fae1a5d4b
SHA512

9327fa1184ef1cb545530ec1c5afe3a151165c2329b557fdc89a70d885dbf2af66f114cbc9ec5101d0369baf5a829efdc096ac2fb349bc7add80f63aad31b894
SSDEEP

1536:0vFv/i0ccnrRyI4bC4hTLWWc1k5+sG6I1170PxETfZ6NRyD:iY0ccNy0yLWWcKG6egPHyD

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2952 wrote to memory of 2044	2952	regsvr32.exe	28
PID 2952 wrote to memory of 2044	2952	regsvr32.exe	28
PID 2952 wrote to memory of 2044	2952	regsvr32.exe	28
PID 2952 wrote to memory of 2044	2952	regsvr32.exe	28
PID 2952 wrote to memory of 2044	2952	regsvr32.exe	28
PID 2952 wrote to memory of 2044	2952	regsvr32.exe	28
PID 2952 wrote to memory of 2044	2952	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\e81dbe9d2ffaaf5b40b74cc6b5ba3fd5_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2952
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\e81dbe9d2ffaaf5b40b74cc6b5ba3fd5_JaffaCakes118.dll
  2⤵
  PID:2044

memory/2044-0-0x00000000006A0000-0x00000000006DF000-memory.dmp

Filesize
252KB

Download