0722f03d70b88daa4f161115d5a43e713c60daafb697904175330e0f4d730e9e

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
20/06/2024, 05:47

Target

035b2813315cddf971e40402ff8ec402_JaffaCakes118.dll
Size

47KB
MD5

035b2813315cddf971e40402ff8ec402
SHA1

34c62607b449d91e97d61b14f218c0c71e157dc1
SHA256

0722f03d70b88daa4f161115d5a43e713c60daafb697904175330e0f4d730e9e
SHA512

8b1ad50bf534c2478984df3e7964a85a33c5131edab220d86658e39f65286887e357ba520f98fedf09f858476114e6c77e4f13486121a3c35ac8ac0fb838add6
SSDEEP

768:sSVMqQCVaQkUwjWnof6hi9k9iO5OpBlRT4zud/JBKV4ZPZISgI4xOHYQngrm:LVMqFVaQbo6hik9iGOpBlRTFnruSgBQ3

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2372 wrote to memory of 1156	2372	regsvr32.exe	28
PID 2372 wrote to memory of 1156	2372	regsvr32.exe	28
PID 2372 wrote to memory of 1156	2372	regsvr32.exe	28
PID 2372 wrote to memory of 1156	2372	regsvr32.exe	28
PID 2372 wrote to memory of 1156	2372	regsvr32.exe	28
PID 2372 wrote to memory of 1156	2372	regsvr32.exe	28
PID 2372 wrote to memory of 1156	2372	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\035b2813315cddf971e40402ff8ec402_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2372
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\035b2813315cddf971e40402ff8ec402_JaffaCakes118.dll
  2⤵
  PID:1156

memory/1156-0-0x0000000000190000-0x00000000001A1000-memory.dmp

Filesize
68KB

Download