f951efbf8f9551eb9e60d010885311ff0ae19dac5ef6302038d044ecba282029

Analysis

max time kernel
117s
max time network
117s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
09/04/2024, 08:35

Target

e99552a5d23544ca0a26b255f7b5e64b_JaffaCakes118.dll
Size

284KB
MD5

e99552a5d23544ca0a26b255f7b5e64b
SHA1

f947f342dc1e67fc7c7fad420117fa0225e9c912
SHA256

f951efbf8f9551eb9e60d010885311ff0ae19dac5ef6302038d044ecba282029
SHA512

c47c2ebc2d8901f816e23ad97956706ed5904a9ee4cf59e1eb4168aec9524dd663fc7279c4445ec6d070f1a3ec0ac456d96f1d21debf9d3f90789513d2925c15
SSDEEP

6144:tlnLOE6niDHCIhgxx+Wn+aC1meyUGimMRfwSLUDLfJb:nGpWgxx+OW1meyUGpoIoUDVb

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1304 wrote to memory of 2212	1304	regsvr32.exe	28
PID 1304 wrote to memory of 2212	1304	regsvr32.exe	28
PID 1304 wrote to memory of 2212	1304	regsvr32.exe	28
PID 1304 wrote to memory of 2212	1304	regsvr32.exe	28
PID 1304 wrote to memory of 2212	1304	regsvr32.exe	28
PID 1304 wrote to memory of 2212	1304	regsvr32.exe	28
PID 1304 wrote to memory of 2212	1304	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\e99552a5d23544ca0a26b255f7b5e64b_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1304
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\e99552a5d23544ca0a26b255f7b5e64b_JaffaCakes118.dll
  2⤵
  PID:2212

memory/2212-0-0x0000000004190000-0x000000000421E000-memory.dmp

Filesize
568KB

Download
memory/2212-1-0x0000000004190000-0x000000000421E000-memory.dmp

Filesize
568KB

Download