cf156e4aff9719ccdffa2535316da0017a4172bd53218f43b650d24b3919f952

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
19-06-2024 18:50

Target

00096185d742ea754e078d7b66f4c3cc_JaffaCakes118.dll
Size

19KB
MD5

00096185d742ea754e078d7b66f4c3cc
SHA1

10202b8324400411d25febb7d5d53c701527ca90
SHA256

cf156e4aff9719ccdffa2535316da0017a4172bd53218f43b650d24b3919f952
SHA512

21833aa0554891c07d51f62f6dba4d0c9e476b27214fa011f2b5e3dc059c558520e2a459b3519445242582dba71b8abf0b09f6efecad6114fdaaec9bebc30b75
SSDEEP

384:LWWTEcWrVeO9PrCZFnFf+KagG2aXq1M37Lit1co6NqxiJxxHieP7zR1:k9oFnFWKal2P826NqEYeP7P

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2180 wrote to memory of 2144	2180	regsvr32.exe	29
PID 2180 wrote to memory of 2144	2180	regsvr32.exe	29
PID 2180 wrote to memory of 2144	2180	regsvr32.exe	29
PID 2180 wrote to memory of 2144	2180	regsvr32.exe	29
PID 2180 wrote to memory of 2144	2180	regsvr32.exe	29
PID 2180 wrote to memory of 2144	2180	regsvr32.exe	29
PID 2180 wrote to memory of 2144	2180	regsvr32.exe	29

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\00096185d742ea754e078d7b66f4c3cc_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2180
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\00096185d742ea754e078d7b66f4c3cc_JaffaCakes118.dll
  2⤵
  PID:2144

memory/2144-0-0x00000000001F0000-0x000000000020D000-memory.dmp

Filesize
116KB

Download