c130e6d5c8698e7390a2288a296881fbebf9458cca4f4629171f1d50afc64ef8

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
20/06/2024, 09:55

Target

04ee895a74b038e693998bb87e154508_JaffaCakes118.dll
Size

90KB
MD5

04ee895a74b038e693998bb87e154508
SHA1

2d27a979a08cdb5862abce18dae197651992d6ba
SHA256

c130e6d5c8698e7390a2288a296881fbebf9458cca4f4629171f1d50afc64ef8
SHA512

4bf2f0413bed51c5a5a1634825e134e1b8971ed901da174119fd27fce67633e70290b1ed9520dc788d0632e15c98017086b18dbce9c26ee9c527b6bcc86318c7
SSDEEP

1536:YaOWqfXFStlTV9fp7YxzwSkaT8ynDPa6Npf5zQFsyscNM/11StqtmPxI0/GuhjSE:YaOWAFSfV9fRwtrDPVpUA1StLG0/jcE

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2072 wrote to memory of 1240	2072	regsvr32.exe	28
PID 2072 wrote to memory of 1240	2072	regsvr32.exe	28
PID 2072 wrote to memory of 1240	2072	regsvr32.exe	28
PID 2072 wrote to memory of 1240	2072	regsvr32.exe	28
PID 2072 wrote to memory of 1240	2072	regsvr32.exe	28
PID 2072 wrote to memory of 1240	2072	regsvr32.exe	28
PID 2072 wrote to memory of 1240	2072	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\04ee895a74b038e693998bb87e154508_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2072
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\04ee895a74b038e693998bb87e154508_JaffaCakes118.dll
  2⤵
  PID:1240

memory/1240-0-0x00000000001E0000-0x0000000000226000-memory.dmp

Filesize
280KB

Download