62c488b5d5f842039ebea805cdd9bc48b602d9ce9c11ad2137001b4c50ac96ef

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
16-04-2024 16:15

Target

f3d8cb5b3b528ecbd300b725129b82ca_JaffaCakes118.dll
Size

89KB
MD5

f3d8cb5b3b528ecbd300b725129b82ca
SHA1

d9e231e683aeb8cd2947d01b95702fe856f49e0d
SHA256

62c488b5d5f842039ebea805cdd9bc48b602d9ce9c11ad2137001b4c50ac96ef
SHA512

fd1feadba42568cda997a6fff5ab19d2e99f5512419d6a66b5e0bdf15150f596069247a6a185a910b8290ac63a84f5a1ff7db2f4def1e41e5fdd1f11400e6e80
SSDEEP

1536:lDo0Msmn4xgU0M9onvYqJaAptf81k5tsFxsruO+8cy4ju4/9XqnvP:po0tmsg9TYqJaY1I1xsr4V10P

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2224 wrote to memory of 2344	2224	regsvr32.exe	28
PID 2224 wrote to memory of 2344	2224	regsvr32.exe	28
PID 2224 wrote to memory of 2344	2224	regsvr32.exe	28
PID 2224 wrote to memory of 2344	2224	regsvr32.exe	28
PID 2224 wrote to memory of 2344	2224	regsvr32.exe	28
PID 2224 wrote to memory of 2344	2224	regsvr32.exe	28
PID 2224 wrote to memory of 2344	2224	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\f3d8cb5b3b528ecbd300b725129b82ca_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2224
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\f3d8cb5b3b528ecbd300b725129b82ca_JaffaCakes118.dll
  2⤵
  PID:2344

memory/2344-0-0x0000000000350000-0x0000000000393000-memory.dmp

Filesize
268KB

Download