aff922a33de85fa8fa70fff7d3279a570de6ccd63a0b937876231d66b889dcca

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15-04-2024 17:44

Target

f1a0322b67d3d88105afe771e8e76447_JaffaCakes118.dll
Size

80KB
MD5

f1a0322b67d3d88105afe771e8e76447
SHA1

bad7faa33636c88d396f297bd5b86631c9f51a2e
SHA256

aff922a33de85fa8fa70fff7d3279a570de6ccd63a0b937876231d66b889dcca
SHA512

dc739064788da718fac3d3eaa90a6b225ec5b2107064db2a6b4c771f976ce1f2670a528f381e0a5ecdf2aafec677d71c221accb774c24dfbf07830e67b2ca804
SSDEEP

1536:x0a67zOnzwtNvKHj8Mw4HdMxjvVWMt4qwinDeqxdUx2aGuaNbWPoJK/c:+aMeqNvLMWI0+inakdUUaGusc0

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1620 wrote to memory of 2000	1620	regsvr32.exe	28
PID 1620 wrote to memory of 2000	1620	regsvr32.exe	28
PID 1620 wrote to memory of 2000	1620	regsvr32.exe	28
PID 1620 wrote to memory of 2000	1620	regsvr32.exe	28
PID 1620 wrote to memory of 2000	1620	regsvr32.exe	28
PID 1620 wrote to memory of 2000	1620	regsvr32.exe	28
PID 1620 wrote to memory of 2000	1620	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\f1a0322b67d3d88105afe771e8e76447_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1620
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\f1a0322b67d3d88105afe771e8e76447_JaffaCakes118.dll
  2⤵
  PID:2000

memory/2000-0-0x00000000004F0000-0x000000000052F000-memory.dmp

Filesize
252KB

Download