d26585079898da8f41ce043d2f5beba39392b841c032ea27fe691e13ced13790

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
18/04/2024, 10:41

Target

f7d301ad0b432858f94c301d74a0a830_JaffaCakes118.dll
Size

90KB
MD5

f7d301ad0b432858f94c301d74a0a830
SHA1

7fe80f75dadfb4e5f15b3151b100b06ad4a3e5fd
SHA256

d26585079898da8f41ce043d2f5beba39392b841c032ea27fe691e13ced13790
SHA512

3f55ade8689cf0748e73ed6223328c1697da79cbfccc81b8cd53fde978c7a8bbab653b8e8b46b2f91b1a248468a0ba4e1b2a95b6b7cc74d2674d10dd37288cf6
SSDEEP

1536:77e74KTEamqNa2lG+b26vasQ8daWPP75qETq74DpgHSKJMkIVkLyfFlG+bE:Xe7LU2l9b26isQ8lPP7F+ZFJMY2Fl9bE

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1808 wrote to memory of 2968	1808	regsvr32.exe	28
PID 1808 wrote to memory of 2968	1808	regsvr32.exe	28
PID 1808 wrote to memory of 2968	1808	regsvr32.exe	28
PID 1808 wrote to memory of 2968	1808	regsvr32.exe	28
PID 1808 wrote to memory of 2968	1808	regsvr32.exe	28
PID 1808 wrote to memory of 2968	1808	regsvr32.exe	28
PID 1808 wrote to memory of 2968	1808	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\f7d301ad0b432858f94c301d74a0a830_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1808
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\f7d301ad0b432858f94c301d74a0a830_JaffaCakes118.dll
  2⤵
  PID:2968

memory/2968-0-0x0000000000170000-0x00000000001B6000-memory.dmp

Filesize
280KB

Download