0bcef071fcb53dd20ff8966effaf8cb3d9806b4d26015a03bd123e59d95d9e5b

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
20/06/2024, 03:06

Target

0248d702f1af8c434c817f6eb0903020_JaffaCakes118.dll
Size

47KB
MD5

0248d702f1af8c434c817f6eb0903020
SHA1

e484fe93b4da71678bdfba33a0eb14977bba7fd6
SHA256

0bcef071fcb53dd20ff8966effaf8cb3d9806b4d26015a03bd123e59d95d9e5b
SHA512

cf5d37f10bbb11da7e2f69f4ef20b15ec4be41bd9e861beb9040261571d58e1bc702cd0a1b6ec8f04ebaa7ee855040c241604189621ca155028156cf4f6919ad
SSDEEP

768:USVMqQCVaQkUwjWnomXxdmdRiO5OpBl2MLgaH4Gf1CYvCO6xOHeQEYttH8:zVMqFVaQbdXkiGOpBl25YaXXQEYtp8

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2360 wrote to memory of 1712	2360	regsvr32.exe	28
PID 2360 wrote to memory of 1712	2360	regsvr32.exe	28
PID 2360 wrote to memory of 1712	2360	regsvr32.exe	28
PID 2360 wrote to memory of 1712	2360	regsvr32.exe	28
PID 2360 wrote to memory of 1712	2360	regsvr32.exe	28
PID 2360 wrote to memory of 1712	2360	regsvr32.exe	28
PID 2360 wrote to memory of 1712	2360	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\0248d702f1af8c434c817f6eb0903020_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2360
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\0248d702f1af8c434c817f6eb0903020_JaffaCakes118.dll
  2⤵
  PID:1712

memory/1712-0-0x0000000000220000-0x0000000000231000-memory.dmp

Filesize
68KB

Download