393c0246c461558bc8b4e30fdaf018f0ddc3d8c4424238c05948a6273b23eaa3

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15/04/2024, 22:20

Target

f20f07e8bd65d321845a9df4b34e12e8_JaffaCakes118.dll
Size

328KB
MD5

f20f07e8bd65d321845a9df4b34e12e8
SHA1

319778ac4706533cbfedbc43a40a6ca11e581f32
SHA256

393c0246c461558bc8b4e30fdaf018f0ddc3d8c4424238c05948a6273b23eaa3
SHA512

b03f3cb4f11aa6c4b60e628417b36920c9731d77c4e8b6d24983542d6f28ed0e677c50d7654d4d0da5931099944e01f8a989c719d621388b92e1c7b97a5e6a12
SSDEEP

6144:QZXISo9g9OTuD2pQFWTq+mUHtQ2mUfzdvbwN/Bvuzi:QJItu9Eu1WTq+urEzdjwN1

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2352 wrote to memory of 2196	2352	regsvr32.exe	28
PID 2352 wrote to memory of 2196	2352	regsvr32.exe	28
PID 2352 wrote to memory of 2196	2352	regsvr32.exe	28
PID 2352 wrote to memory of 2196	2352	regsvr32.exe	28
PID 2352 wrote to memory of 2196	2352	regsvr32.exe	28
PID 2352 wrote to memory of 2196	2352	regsvr32.exe	28
PID 2352 wrote to memory of 2196	2352	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\f20f07e8bd65d321845a9df4b34e12e8_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2352
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\f20f07e8bd65d321845a9df4b34e12e8_JaffaCakes118.dll
  2⤵
  PID:2196

memory/2196-0-0x0000000010000000-0x0000000010052000-memory.dmp

Filesize
328KB

Download