ed954217d1eade30314b031ae7266958a99fe3069d0d99f8373a932a48fb86dd

Analysis

max time kernel
122s
max time network
122s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
20/06/2024, 04:31

Target

02d17556555ae5f577be6300e4a1c998_JaffaCakes118.dll
Size

87KB
MD5

02d17556555ae5f577be6300e4a1c998
SHA1

f091ffee4faec7162f3aaeb4b40739f57e511073
SHA256

ed954217d1eade30314b031ae7266958a99fe3069d0d99f8373a932a48fb86dd
SHA512

9e8d81d8cec0703a4b829afdfd0daf739f6d224b990057260667d56e1de90361feb2c1e54058dce07dfcfb7b868f10092aeea96cfe0fb0f0963c199b79d4b9b5
SSDEEP

1536:X0IzQWqT+C/GmAvDBtvLDWzEMz9eVDrFiuJ7rXs+qEhC/z:X0jT+CNSDBtvvWHgrFiuJ7zOeC7

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2152 wrote to memory of 2924	2152	regsvr32.exe	28
PID 2152 wrote to memory of 2924	2152	regsvr32.exe	28
PID 2152 wrote to memory of 2924	2152	regsvr32.exe	28
PID 2152 wrote to memory of 2924	2152	regsvr32.exe	28
PID 2152 wrote to memory of 2924	2152	regsvr32.exe	28
PID 2152 wrote to memory of 2924	2152	regsvr32.exe	28
PID 2152 wrote to memory of 2924	2152	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\02d17556555ae5f577be6300e4a1c998_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2152
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\02d17556555ae5f577be6300e4a1c998_JaffaCakes118.dll
  2⤵
  PID:2924

memory/2924-0-0x00000000001E0000-0x0000000000223000-memory.dmp

Filesize
268KB

Download