48fd65aadebf5c7ca2feef9476c7ce9ccd3be0a6913c57d2c4366028c2531c49

Analysis

max time kernel
119s
max time network
119s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
20/06/2024, 02:34

Target

02138bb1845ce86acbdc9c4841df7c7d_JaffaCakes118.dll
Size

64KB
MD5

02138bb1845ce86acbdc9c4841df7c7d
SHA1

5dde4d99908a92af423c87fd7dce618cd1b4bfb2
SHA256

48fd65aadebf5c7ca2feef9476c7ce9ccd3be0a6913c57d2c4366028c2531c49
SHA512

bbdb6d27b5c4a4b60def21a5f4679eb73ddf55bb0c7010fcdb74bef1cdcfac1d6d8826b6a9c6e2e5b67872fc53ee3dad75d3c1c88488d4f6b8eca6c7c8e2eb6b
SSDEEP

768:meP9h/yYSgx7PQLKZ4883ZQVxRwuH7bDeP9h/yYSgx7PQLKZ4883ZQVxRwuH7b:mkf/ydyQL18xHfHDkf/ydyQL18xHfH

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2848 wrote to memory of 2036	2848	regsvr32.exe	28
PID 2848 wrote to memory of 2036	2848	regsvr32.exe	28
PID 2848 wrote to memory of 2036	2848	regsvr32.exe	28
PID 2848 wrote to memory of 2036	2848	regsvr32.exe	28
PID 2848 wrote to memory of 2036	2848	regsvr32.exe	28
PID 2848 wrote to memory of 2036	2848	regsvr32.exe	28
PID 2848 wrote to memory of 2036	2848	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\02138bb1845ce86acbdc9c4841df7c7d_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2848
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\02138bb1845ce86acbdc9c4841df7c7d_JaffaCakes118.dll
  2⤵
  PID:2036

memory/2036-0-0x00000000000C0000-0x00000000000CD000-memory.dmp

Filesize
52KB

Download