4eed059510fe9e1b3a457114c121eb8a29909d1fe8a483ff5f69f94a344b5fd4

Analysis

max time kernel
118s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
20/04/2024, 07:09

Target

fc345e84f5b7b01cb89705f63375465f_JaffaCakes118.dll
Size

183KB
MD5

fc345e84f5b7b01cb89705f63375465f
SHA1

b6f28cef47d5f922deb27248aa90725fe78ae417
SHA256

4eed059510fe9e1b3a457114c121eb8a29909d1fe8a483ff5f69f94a344b5fd4
SHA512

8488bcc4ed6bf4bfa8860499ffdc70d04c4fa5bfb0b58bf2c8c73d024b9793d93db446e1bb3cca5e72b5435c2fdc4275faa48950d01d564ce3bb7dba9cbc9f9c
SSDEEP

3072:18+5OUEfsFKVsFKVsFKVsFKVsFKVsFKVsFKVsFKVsFKVsFKi:18+OzfrVrVrVrVrVrVrVrVrVri

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1708 wrote to memory of 2892	1708	regsvr32.exe	28
PID 1708 wrote to memory of 2892	1708	regsvr32.exe	28
PID 1708 wrote to memory of 2892	1708	regsvr32.exe	28
PID 1708 wrote to memory of 2892	1708	regsvr32.exe	28
PID 1708 wrote to memory of 2892	1708	regsvr32.exe	28
PID 1708 wrote to memory of 2892	1708	regsvr32.exe	28
PID 1708 wrote to memory of 2892	1708	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\fc345e84f5b7b01cb89705f63375465f_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1708
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\fc345e84f5b7b01cb89705f63375465f_JaffaCakes118.dll
  2⤵
  PID:2892

memory/2892-0-0x0000000000180000-0x0000000000195000-memory.dmp

Filesize
84KB

Download
memory/2892-1-0x0000000000180000-0x0000000000195000-memory.dmp

Filesize
84KB

Download