fa8642ddc68bd605f1f5ab99c0beaef95a3eeed729a3df08e4044b3250c656ee

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
20-06-2024 05:38

Target

034b7c054f0451823712feb207172d87_JaffaCakes118.dll
Size

21KB
MD5

034b7c054f0451823712feb207172d87
SHA1

3bd5d63c3830cbf8245a330238a7c4f846f5272d
SHA256

fa8642ddc68bd605f1f5ab99c0beaef95a3eeed729a3df08e4044b3250c656ee
SHA512

518876b6e5380ded61eec751df13542f8c7fb4682c31b7c64e9856fc8f4854bd7a6cb6a180421e3a931884b6f03ff8f1f26dc4c393f13bb6a28dadf363e01ab8
SSDEEP

384:Ns1DrX0hc9x4Iqdk88YZS3VvvwoqsfobTvyJbBhBC6qO/+fSaYIafwXLfnMx4lnZ:yr02r4DRvSlHQsfoXyJdjFL+XXLPARB0

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 2116 wrote to memory of 2988	2116	regsvr32.exe	regsvr32.exe
PID 2116 wrote to memory of 2988	2116	regsvr32.exe	regsvr32.exe
PID 2116 wrote to memory of 2988	2116	regsvr32.exe	regsvr32.exe
PID 2116 wrote to memory of 2988	2116	regsvr32.exe	regsvr32.exe
PID 2116 wrote to memory of 2988	2116	regsvr32.exe	regsvr32.exe
PID 2116 wrote to memory of 2988	2116	regsvr32.exe	regsvr32.exe
PID 2116 wrote to memory of 2988	2116	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\034b7c054f0451823712feb207172d87_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2116

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\034b7c054f0451823712feb207172d87_JaffaCakes118.dll
2⤵
PID:2988

memory/2988-0-0x00000000001D0000-0x00000000001F4000-memory.dmp

Filesize
144KB

Download