275108502ef806957d6a93b35ddcefde0879807e73d958782e53626fecc6d441

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
20-06-2024 17:29

Target

083ecbcd136ff8d393c91a121aefcdd3_JaffaCakes118.dll
Size

47KB
MD5

083ecbcd136ff8d393c91a121aefcdd3
SHA1

e090264d3aa34b7d4647512a7aaa8daa86ee2ed4
SHA256

275108502ef806957d6a93b35ddcefde0879807e73d958782e53626fecc6d441
SHA512

7d5778c1796e4bb71e0034b8cbbc999fed55261e4fa7f91797251a5a3c42655ca9c63829d49333c46da47d7637dc0d369491164fcf8b37d084076288534eed82
SSDEEP

768:9SVMqQCVaQkUwjWnoeE0nEhziO5OpBlgg6QfN8yQ4lyyUZzmojDN9us0ExvxOHez:cVMqFVaQbPE9hziGOpBlggLQyADDN5p3

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1996 wrote to memory of 1732	1996	regsvr32.exe	28
PID 1996 wrote to memory of 1732	1996	regsvr32.exe	28
PID 1996 wrote to memory of 1732	1996	regsvr32.exe	28
PID 1996 wrote to memory of 1732	1996	regsvr32.exe	28
PID 1996 wrote to memory of 1732	1996	regsvr32.exe	28
PID 1996 wrote to memory of 1732	1996	regsvr32.exe	28
PID 1996 wrote to memory of 1732	1996	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\083ecbcd136ff8d393c91a121aefcdd3_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1996
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\083ecbcd136ff8d393c91a121aefcdd3_JaffaCakes118.dll
  2⤵
  PID:1732

memory/1732-0-0x00000000001B0000-0x00000000001C1000-memory.dmp

Filesize
68KB

Download