58fb2d971a99379c3583a98ea9659b21bacb50facda6234559d9020c4c582f3c

Analysis

max time kernel
122s
max time network
122s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
18/04/2024, 05:27

Target

f75b73e18a20f77a585e941e2d2f0629_JaffaCakes118.dll
Size

239KB
MD5

f75b73e18a20f77a585e941e2d2f0629
SHA1

31a344f3aaeadfaaac3885ee42afc1a5368fc591
SHA256

58fb2d971a99379c3583a98ea9659b21bacb50facda6234559d9020c4c582f3c
SHA512

72b029c3be18d73e875b06f80abc330d33e20b1f32996e16fa75aefdfcbf9d405a549126128484e8ef707981ec8508921ef3636f6c503ad7a27507e517f40db0
SSDEEP

3072:B5N4odXr2vrb8JEb8JEb8JEb8JEb8JEb8JEb8JEb8JEb8JEb8Je:B5NDlruHzzzzzzzzzn

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2460 wrote to memory of 2720	2460	regsvr32.exe	28
PID 2460 wrote to memory of 2720	2460	regsvr32.exe	28
PID 2460 wrote to memory of 2720	2460	regsvr32.exe	28
PID 2460 wrote to memory of 2720	2460	regsvr32.exe	28
PID 2460 wrote to memory of 2720	2460	regsvr32.exe	28
PID 2460 wrote to memory of 2720	2460	regsvr32.exe	28
PID 2460 wrote to memory of 2720	2460	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\f75b73e18a20f77a585e941e2d2f0629_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2460
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\f75b73e18a20f77a585e941e2d2f0629_JaffaCakes118.dll
  2⤵
  PID:2720

memory/2720-0-0x0000000000480000-0x000000000049A000-memory.dmp

Filesize
104KB

Download