cacfa372b0dc942297e06d12e7a9ff40660e25e34973b21c6a081e9245d54980

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
20-06-2024 16:20

Target

07af30cee51123b544f32039a47861f7_JaffaCakes118.dll
Size

47KB
MD5

07af30cee51123b544f32039a47861f7
SHA1

282770d5426195e363c91e25dbbebf6d7eab0b2c
SHA256

cacfa372b0dc942297e06d12e7a9ff40660e25e34973b21c6a081e9245d54980
SHA512

c99cda70b089c630448506c9d8da5fe15d70c129c16e3e8dca3c2136a6ddd5924aac5a23bb8fd4cf27a9af3830642753ca12eae9b14ed16c8ea2b83629124681
SSDEEP

768:wSVMqQCVaQkUwjWnolH01tZjiO5OpBlkSblLfqRRWvGfFeiatCV3xOHAQFAr:nVMqFVaQbOH0jZjiGOpBlkSbl+awgCXt

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2980 wrote to memory of 2540	2980	regsvr32.exe	28
PID 2980 wrote to memory of 2540	2980	regsvr32.exe	28
PID 2980 wrote to memory of 2540	2980	regsvr32.exe	28
PID 2980 wrote to memory of 2540	2980	regsvr32.exe	28
PID 2980 wrote to memory of 2540	2980	regsvr32.exe	28
PID 2980 wrote to memory of 2540	2980	regsvr32.exe	28
PID 2980 wrote to memory of 2540	2980	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\07af30cee51123b544f32039a47861f7_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2980
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\07af30cee51123b544f32039a47861f7_JaffaCakes118.dll
  2⤵
  PID:2540

memory/2540-0-0x00000000001A0000-0x00000000001B1000-memory.dmp

Filesize
68KB

Download