bdd484631765b424276a42d2e5d3e2a0ef8a51e39a487d9249ba3ccef5a5ef78

Analysis

max time kernel
117s
max time network
122s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
20-06-2024 15:36

Target

0758a7fbe70746c53814f3cdad9a199f_JaffaCakes118.dll
Size

29KB
MD5

0758a7fbe70746c53814f3cdad9a199f
SHA1

45ac50222733406ebc01af78a3b4cbbd45b2bd61
SHA256

bdd484631765b424276a42d2e5d3e2a0ef8a51e39a487d9249ba3ccef5a5ef78
SHA512

ffd71af8ae7e7a38f51184cc707a52cc67691fd5c319baa24c4dd6b224e4146d6c41b772f4db0c43ecb287a57c6df2561706d256ae12fd6ffb308ebc9d39540b
SSDEEP

768:HKSqquxD0GQjgRJMeBLEwzGx7pnnfs46dhG9ie:9qquxD0GQSPBLvaLmE9

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1672 wrote to memory of 2172	1672	regsvr32.exe	28
PID 1672 wrote to memory of 2172	1672	regsvr32.exe	28
PID 1672 wrote to memory of 2172	1672	regsvr32.exe	28
PID 1672 wrote to memory of 2172	1672	regsvr32.exe	28
PID 1672 wrote to memory of 2172	1672	regsvr32.exe	28
PID 1672 wrote to memory of 2172	1672	regsvr32.exe	28
PID 1672 wrote to memory of 2172	1672	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\0758a7fbe70746c53814f3cdad9a199f_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1672
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\0758a7fbe70746c53814f3cdad9a199f_JaffaCakes118.dll
  2⤵
  PID:2172

memory/2172-0-0x0000000000340000-0x000000000034D000-memory.dmp

Filesize
52KB

Download