c96204b0c2dd068f68937dd112e5c0d83dfa9d06204f91b822f30f6871b5fec2

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
19/06/2024, 20:30

Target

0059cfbc948fa005fa41ed62e83e56ba_JaffaCakes118.dll
Size

31KB
MD5

0059cfbc948fa005fa41ed62e83e56ba
SHA1

bd8fa8a65cca453cd5340e7b0b120c653caa9609
SHA256

c96204b0c2dd068f68937dd112e5c0d83dfa9d06204f91b822f30f6871b5fec2
SHA512

0f1ad718d53ed7f8fde16b2d9b8bc5d2ebba930bb658a9873dadd7e0ccf10785c9c291fad22ff5f9040eaa611c6e5c314d5db8551bcf53054071967ddb56f4ca
SSDEEP

384:s59+PbhI7kZp9Lsq6vlIOkgwPiYcbrWhDtQspprVzn/11mRgCdo+p8AXeJG0z2m7:o+ThI7GnWA5xz91+SG0KmxKsw/

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1596 wrote to memory of 2172	1596	regsvr32.exe	28
PID 1596 wrote to memory of 2172	1596	regsvr32.exe	28
PID 1596 wrote to memory of 2172	1596	regsvr32.exe	28
PID 1596 wrote to memory of 2172	1596	regsvr32.exe	28
PID 1596 wrote to memory of 2172	1596	regsvr32.exe	28
PID 1596 wrote to memory of 2172	1596	regsvr32.exe	28
PID 1596 wrote to memory of 2172	1596	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\0059cfbc948fa005fa41ed62e83e56ba_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1596
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\0059cfbc948fa005fa41ed62e83e56ba_JaffaCakes118.dll
  2⤵
  PID:2172

memory/2172-0-0x00000000000C0000-0x00000000000CD000-memory.dmp

Filesize
52KB

Download