8c14f6cb07fd5701cfba55ef3fe0cc63b934bcdd528dfcb33734a1d884c6e115

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
19/06/2024, 18:39

Target

0001d26d01641a8114257262516459b2_JaffaCakes118.dll
Size

19KB
MD5

0001d26d01641a8114257262516459b2
SHA1

e59f9b1db16532b53b0e13b5da8c8c5d0a4b9a6d
SHA256

8c14f6cb07fd5701cfba55ef3fe0cc63b934bcdd528dfcb33734a1d884c6e115
SHA512

69540a3b645a911bc0f84a2b063fd8d6587270a66007df9ff49b9facaca3227941513b401ffed736a139c1a2e66dc33e8fd94dc34c3c83e0a83e3404a289a84e
SSDEEP

384:4WWTEcWGPJO3U2ztAwRXVRDjaoxAkQR20qS/Tzp0NJNiFBqCACpSN:zqQD+AfqkQwEANiBqCXp+

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2980 wrote to memory of 1396	2980	regsvr32.exe	28
PID 2980 wrote to memory of 1396	2980	regsvr32.exe	28
PID 2980 wrote to memory of 1396	2980	regsvr32.exe	28
PID 2980 wrote to memory of 1396	2980	regsvr32.exe	28
PID 2980 wrote to memory of 1396	2980	regsvr32.exe	28
PID 2980 wrote to memory of 1396	2980	regsvr32.exe	28
PID 2980 wrote to memory of 1396	2980	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\0001d26d01641a8114257262516459b2_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2980
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\0001d26d01641a8114257262516459b2_JaffaCakes118.dll
  2⤵
  PID:1396

memory/1396-0-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download