bdbc9679b7fe33b14576a6dc66b009b07a16ab4a81cd65335bde5ecbf24f3714

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
11/04/2024, 14:02

Target

ed974388c209d9d82d7df1089a2adc68_JaffaCakes118.exe
Size

497KB
MD5

ed974388c209d9d82d7df1089a2adc68
SHA1

87d8bb2258b7c879e96b896914e2752a5023237f
SHA256

bdbc9679b7fe33b14576a6dc66b009b07a16ab4a81cd65335bde5ecbf24f3714
SHA512

52021ab5ce0dc3f1473c3d09698cd05b8a73474ee3ba1e3d2ddaef0535870646e83e44a9e38c2bad108d247e03e170aef0ddae0ea5488e736f65c4e23415f5da
SSDEEP

6144:sj8+VuwyNitjgepDgmKHXlVUbIDJ4skoCnj0xIA7Tl4TMaS465VP:sQh/AtEoMVH14VbewBSP

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1308 wrote to memory of 1748	1308	regsvr32.exe	28
PID 1308 wrote to memory of 1748	1308	regsvr32.exe	28
PID 1308 wrote to memory of 1748	1308	regsvr32.exe	28
PID 1308 wrote to memory of 1748	1308	regsvr32.exe	28
PID 1308 wrote to memory of 1748	1308	regsvr32.exe	28
PID 1308 wrote to memory of 1748	1308	regsvr32.exe	28
PID 1308 wrote to memory of 1748	1308	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\ed974388c209d9d82d7df1089a2adc68_JaffaCakes118.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:1308
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\ed974388c209d9d82d7df1089a2adc68_JaffaCakes118.exe
  2⤵
  PID:1748