a219f83f56d49adb1dcda0120c124384cf7f25b71b48e607503e5a6a62a9ceb5

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
21-04-2024 00:41

Target

fe06641b8a955a3601c3abd4587180b3_JaffaCakes118.dll
Size

128KB
MD5

fe06641b8a955a3601c3abd4587180b3
SHA1

81570f492ba5b77a68f599d27c8b68668595714c
SHA256

a219f83f56d49adb1dcda0120c124384cf7f25b71b48e607503e5a6a62a9ceb5
SHA512

0ba6b898437a44a487dc3bde8f734c82de6258d2e09461f483fbcedeb021693683eaa63a051aa1d2474efd6d75be1c35bb4ec616f4472a8b28190a95bf2d622f
SSDEEP

768:H2fCZqoQO8obQ0xJTK229keAdhrIohbtyN17a7XOueWHCf3qKUihcoJHO9Udmn1:HrZqoQybQ6Thhr1bc17azHA6BKr89U+

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2216 wrote to memory of 2244	2216	regsvr32.exe	28
PID 2216 wrote to memory of 2244	2216	regsvr32.exe	28
PID 2216 wrote to memory of 2244	2216	regsvr32.exe	28
PID 2216 wrote to memory of 2244	2216	regsvr32.exe	28
PID 2216 wrote to memory of 2244	2216	regsvr32.exe	28
PID 2216 wrote to memory of 2244	2216	regsvr32.exe	28
PID 2216 wrote to memory of 2244	2216	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\fe06641b8a955a3601c3abd4587180b3_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2216
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\fe06641b8a955a3601c3abd4587180b3_JaffaCakes118.dll
  2⤵
  PID:2244

memory/2244-0-0x00000000001E0000-0x0000000000200000-memory.dmp

Filesize
128KB

Download
memory/2244-1-0x00000000001E0000-0x0000000000200000-memory.dmp

Filesize
128KB

Download