a89fda9990eee55c96aa9e85a04105e983f2456b03624f32b9f254bd84bcf65d | Triage

Analysis

max time kernel
122s
max time network
128s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
08/04/2024, 18:13

Sharing

Report Analysis Logs

General

Target

e819abc9ef47d4d372e118f010ce2343_JaffaCakes118.dll
Size

227KB
MD5

e819abc9ef47d4d372e118f010ce2343
SHA1

d30903f4487ff24ef78cf6179c1c3fe474e17965
SHA256

a89fda9990eee55c96aa9e85a04105e983f2456b03624f32b9f254bd84bcf65d
SHA512

72990f711652ef1ef64a38718ada30c318b89595444934e60c715fc96f2144bcc5dca47c3ac77e736cc90ace064538df4504ced7c16dad19398918dedf0ded2a
SSDEEP

6144:fW4TRMW4TRMW4TRMW4TRMW4TRMW4TRMW4TR:f000000

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 848 wrote to memory of 2796	848	regsvr32.exe	28
PID 848 wrote to memory of 2796	848	regsvr32.exe	28
PID 848 wrote to memory of 2796	848	regsvr32.exe	28
PID 848 wrote to memory of 2796	848	regsvr32.exe	28
PID 848 wrote to memory of 2796	848	regsvr32.exe	28
PID 848 wrote to memory of 2796	848	regsvr32.exe	28
PID 848 wrote to memory of 2796	848	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\e819abc9ef47d4d372e118f010ce2343_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:848
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\e819abc9ef47d4d372e118f010ce2343_JaffaCakes118.dll
  2⤵
  PID:2796

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2796-0-0x00000000002B0000-0x00000000002BD000-memory.dmp

Filesize
52KB

Download