ca8d7120df1969a8f1e048d418b38781a2a73048357b599727be419dd7e0efbb

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
17/04/2024, 09:49

Target

f57fa0c3c5c76d2000c89466885c141f_JaffaCakes118.dll
Size

120KB
MD5

f57fa0c3c5c76d2000c89466885c141f
SHA1

aaf349dbbeb2db99b1dac136dc45828fb63a9767
SHA256

ca8d7120df1969a8f1e048d418b38781a2a73048357b599727be419dd7e0efbb
SHA512

fe3284a47cc73f393c958f47e13feb505ac94c294ad4dd000ca5fb64a414c96262b7e6a869364cd4fd6b2016b17ebf26a6afabfa418c30312e650c6b93c2dbfd
SSDEEP

1536:tNqMQlu4XMKTwjaDKj+VeK6TV6P19UCRg1gOVAq:bmu4jTwj1JKMGgCRgaq

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2692 wrote to memory of 2740	2692	regsvr32.exe	28
PID 2692 wrote to memory of 2740	2692	regsvr32.exe	28
PID 2692 wrote to memory of 2740	2692	regsvr32.exe	28
PID 2692 wrote to memory of 2740	2692	regsvr32.exe	28
PID 2692 wrote to memory of 2740	2692	regsvr32.exe	28
PID 2692 wrote to memory of 2740	2692	regsvr32.exe	28
PID 2692 wrote to memory of 2740	2692	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\f57fa0c3c5c76d2000c89466885c141f_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2692
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\f57fa0c3c5c76d2000c89466885c141f_JaffaCakes118.dll
  2⤵
  PID:2740

memory/2740-0-0x0000000000340000-0x000000000035E000-memory.dmp

Filesize
120KB

Download
memory/2740-1-0x0000000000340000-0x000000000035E000-memory.dmp

Filesize
120KB

Download