09b0020ee179aa8c80a203c93ace8b6610f532247833d4ac12d1c0abd632d5d6

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
20/06/2024, 14:18

Target

06c10ec61c7c16c469d6982dc548fe63_JaffaCakes118.dll
Size

47KB
MD5

06c10ec61c7c16c469d6982dc548fe63
SHA1

153d5c104a6e00e1bfdbb6338fc5db4e7ea959a6
SHA256

09b0020ee179aa8c80a203c93ace8b6610f532247833d4ac12d1c0abd632d5d6
SHA512

0c86ae5fc9d5a34e6090ea1ac8a24c459395af50da04b87ff23ebc2fe4b8c870f7c57ab2f069d7ad730f43877c3ea8410c6f57088d6775d9217acf6b66e9d704
SSDEEP

768:MSVMqQCVaQkUwjWnoGw/Z2+KhniiO5OpBlw1qSRRLfuy/oDY2wrRjxOHgQjv:rVMqFVaQbo/Z2hniiGOpBlwvo4PZQjv

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2084 wrote to memory of 2100	2084	regsvr32.exe	28
PID 2084 wrote to memory of 2100	2084	regsvr32.exe	28
PID 2084 wrote to memory of 2100	2084	regsvr32.exe	28
PID 2084 wrote to memory of 2100	2084	regsvr32.exe	28
PID 2084 wrote to memory of 2100	2084	regsvr32.exe	28
PID 2084 wrote to memory of 2100	2084	regsvr32.exe	28
PID 2084 wrote to memory of 2100	2084	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\06c10ec61c7c16c469d6982dc548fe63_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2084
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\06c10ec61c7c16c469d6982dc548fe63_JaffaCakes118.dll
  2⤵
  PID:2100