9730a719c4c88ac8365e15aabd702c2352f63a8dc5848cd6e930ca8f1f7b305b

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20240319-en
resource tags

arch:x64arch:x86image:win7-20240319-enlocale:en-usos:windows7-x64system
submitted
10/04/2024, 18:55

Target

ebc3082b45663f931dcbdd11615a25d5_JaffaCakes118.dll
Size

77KB
MD5

ebc3082b45663f931dcbdd11615a25d5
SHA1

5a0c2e08878d9ba6f6803323438c2eeeda54c754
SHA256

9730a719c4c88ac8365e15aabd702c2352f63a8dc5848cd6e930ca8f1f7b305b
SHA512

9f91e84da971358c60f0430b489bea9d7e745d5df809825169a571d484b400786dd7884368dff5caa2d91958c1a2cd15c134cbf4c009a2c9335f3c8a588e97a8
SSDEEP

1536:cMMYODCGI9sJgfuCPyQwhhgaO300DPK77COXVLwS7qLTVYNmRFf:cMsCamfpoc4DlLwWNmRFf

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1800 wrote to memory of 1784	1800	regsvr32.exe	28
PID 1800 wrote to memory of 1784	1800	regsvr32.exe	28
PID 1800 wrote to memory of 1784	1800	regsvr32.exe	28
PID 1800 wrote to memory of 1784	1800	regsvr32.exe	28
PID 1800 wrote to memory of 1784	1800	regsvr32.exe	28
PID 1800 wrote to memory of 1784	1800	regsvr32.exe	28
PID 1800 wrote to memory of 1784	1800	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\ebc3082b45663f931dcbdd11615a25d5_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1800
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\ebc3082b45663f931dcbdd11615a25d5_JaffaCakes118.dll
  2⤵
  PID:1784

memory/1784-0-0x0000000000180000-0x00000000001BD000-memory.dmp

Filesize
244KB

Download