ca86450ec13f1d39942db4f5a01ee9cd225aabc2a666e479b5a8628074d4af4f

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
16-04-2024 17:00

Target

f3eb90431aa8a109d0219d8072d7c23b_JaffaCakes118.dll
Size

120KB
MD5

f3eb90431aa8a109d0219d8072d7c23b
SHA1

fb97477f9c989ff3ce7033e2b6e8bd6f81f8f00d
SHA256

ca86450ec13f1d39942db4f5a01ee9cd225aabc2a666e479b5a8628074d4af4f
SHA512

a188705ce622e0fb4b984cb2e499c617832e2167072a862de738fb3a59cc5bc388502984a97dd5e35228a115f6582e08d9e8dbbf510600eccc44b70c2277c1e4
SSDEEP

1536:trVq1QLko9egQKFesV4uHIVENTAs3Qcn/VPJgoJn8:2YkolQKFalENTXAcn/VPJgL

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2232 wrote to memory of 1928	2232	regsvr32.exe	28
PID 2232 wrote to memory of 1928	2232	regsvr32.exe	28
PID 2232 wrote to memory of 1928	2232	regsvr32.exe	28
PID 2232 wrote to memory of 1928	2232	regsvr32.exe	28
PID 2232 wrote to memory of 1928	2232	regsvr32.exe	28
PID 2232 wrote to memory of 1928	2232	regsvr32.exe	28
PID 2232 wrote to memory of 1928	2232	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\f3eb90431aa8a109d0219d8072d7c23b_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2232
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\f3eb90431aa8a109d0219d8072d7c23b_JaffaCakes118.dll
  2⤵
  PID:1928

memory/1928-0-0x00000000001F0000-0x000000000020E000-memory.dmp

Filesize
120KB

Download