8424541d06fcf342dc8009c0d247e8c98b1b26a6f402b9803ee60a0be44299f8

Analysis

max time kernel
119s
max time network
122s
platform
windows7_x64
resource
win7-20240319-en
resource tags

arch:x64arch:x86image:win7-20240319-enlocale:en-usos:windows7-x64system
submitted
18-04-2024 14:00

Target

f825fd0b08a5d79e5fad1e50e64d088a_JaffaCakes118.dll
Size

120KB
MD5

f825fd0b08a5d79e5fad1e50e64d088a
SHA1

a2034bb5aa9a194fe8ae66c744c1f0b56cbf7404
SHA256

8424541d06fcf342dc8009c0d247e8c98b1b26a6f402b9803ee60a0be44299f8
SHA512

6650bbfd6c2f0fccdc47ac4aec80ba130bba15ab95c573e1f69bb4f2145e4f4dfb82ca92f243ef86332d4af11ece5edf5e8ad5aa217c851f907b4a0035c33551
SSDEEP

768:IeP9h5Sq0fnpdPT9xWwVmeP9h5Sq0fnpdPT9xWwVmeP9h5Sq0fnpdPT9xWwVmeP:IkfsdPhekfsdPhekfsdPhekfsdPh

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1336 wrote to memory of 2300	1336	regsvr32.exe	28
PID 1336 wrote to memory of 2300	1336	regsvr32.exe	28
PID 1336 wrote to memory of 2300	1336	regsvr32.exe	28
PID 1336 wrote to memory of 2300	1336	regsvr32.exe	28
PID 1336 wrote to memory of 2300	1336	regsvr32.exe	28
PID 1336 wrote to memory of 2300	1336	regsvr32.exe	28
PID 1336 wrote to memory of 2300	1336	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\f825fd0b08a5d79e5fad1e50e64d088a_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1336
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\f825fd0b08a5d79e5fad1e50e64d088a_JaffaCakes118.dll
  2⤵
  PID:2300

memory/2300-0-0x00000000001C0000-0x00000000001CD000-memory.dmp

Filesize
52KB

Download