42b2cd4dad1ea294300fdb103915ee535587e7f90288cab710b659467234fe82

Analysis

max time kernel
117s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
19-04-2024 00:39

Target

f91e23d2d279086f5457d7af1dba0ccd_JaffaCakes118.dll
Size

4.9MB
MD5

f91e23d2d279086f5457d7af1dba0ccd
SHA1

d3ea37c75227f62df1c107ed43afe2d1c9598e5c
SHA256

42b2cd4dad1ea294300fdb103915ee535587e7f90288cab710b659467234fe82
SHA512

11c7bae7c3e41fce23c09f3cdcc78201beba82810bd9b0877d21faa61e32a3e9bf098c73faa81e96333fda8ce8f434e28375f4c14ab9596bd1091ed7785baa0d
SSDEEP

98304:0XJbjOdRTNhVNwb64wmsBtAJzVTx+HzF0dFGNi0mSG6GH63Ju6eGj:mJ4T9N/esBOJz9xoh03G0fP63JuQ

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1540 wrote to memory of 2848	1540	regsvr32.exe	28
PID 1540 wrote to memory of 2848	1540	regsvr32.exe	28
PID 1540 wrote to memory of 2848	1540	regsvr32.exe	28
PID 1540 wrote to memory of 2848	1540	regsvr32.exe	28
PID 1540 wrote to memory of 2848	1540	regsvr32.exe	28
PID 1540 wrote to memory of 2848	1540	regsvr32.exe	28
PID 1540 wrote to memory of 2848	1540	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\f91e23d2d279086f5457d7af1dba0ccd_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1540
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\f91e23d2d279086f5457d7af1dba0ccd_JaffaCakes118.dll
  2⤵
  PID:2848