d3adddbe8e627863067c132f035bfae05f9d01a9ad528835e562231cd6aeee9b

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15-06-2024 08:39

Target

ad949132a8696d0f1573700c93d9719e_JaffaCakes118.dll
Size

445KB
MD5

ad949132a8696d0f1573700c93d9719e
SHA1

a3381a170f50a2c6a34db631222cd1fd326f1d3f
SHA256

d3adddbe8e627863067c132f035bfae05f9d01a9ad528835e562231cd6aeee9b
SHA512

c33ef4f7f75fe065cba09db2a2f98eee637996f6c3ae50693415735f4e3acb3edcd05a19482ae9503a124df3084bc25cf35f31d50de4ce5181c564316fd12cbc
SSDEEP

6144:tapDmaaLyW8ulrhaP3puiWpJG5cgcsHSA9/KPMCFyyURsqpMGzrE/D0RGq9T/:EpDJP6JGisHSA9/2MCF/UMGMIj

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2880 wrote to memory of 2368	2880	regsvr32.exe	28
PID 2880 wrote to memory of 2368	2880	regsvr32.exe	28
PID 2880 wrote to memory of 2368	2880	regsvr32.exe	28
PID 2880 wrote to memory of 2368	2880	regsvr32.exe	28
PID 2880 wrote to memory of 2368	2880	regsvr32.exe	28
PID 2880 wrote to memory of 2368	2880	regsvr32.exe	28
PID 2880 wrote to memory of 2368	2880	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\ad949132a8696d0f1573700c93d9719e_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2880
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\ad949132a8696d0f1573700c93d9719e_JaffaCakes118.dll
  2⤵
  PID:2368