29769d04d492b5e7022afc2ba7af9f487d3ce2f9b164b1a189c389a42b77995f

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
24-06-2024 10:54

Target

0819680f9633ccc846b3776cbc382bad_JaffaCakes118.dll
Size

64KB
MD5

0819680f9633ccc846b3776cbc382bad
SHA1

93480c5c4d6c78b40df8b02aedf1fea4537a4b0d
SHA256

29769d04d492b5e7022afc2ba7af9f487d3ce2f9b164b1a189c389a42b77995f
SHA512

1abd9a4b75ee808b40a523bafd27b1c8134c68d59d1c66d251ccd7ad667a3b861100352b9c49f3f91fc01fce2aeffa9ba355b776351f31b350bfb28f6b270c03
SSDEEP

768:GTQ4Ghajq27LWlRJl/ny+0083sOWXezr5PqZwkk/aPi0C7FupuuBmIu:W0gZfwRPyhsMPqZFVCIFBmIu

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2080 wrote to memory of 1956	2080	regsvr32.exe	28
PID 2080 wrote to memory of 1956	2080	regsvr32.exe	28
PID 2080 wrote to memory of 1956	2080	regsvr32.exe	28
PID 2080 wrote to memory of 1956	2080	regsvr32.exe	28
PID 2080 wrote to memory of 1956	2080	regsvr32.exe	28
PID 2080 wrote to memory of 1956	2080	regsvr32.exe	28
PID 2080 wrote to memory of 1956	2080	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\0819680f9633ccc846b3776cbc382bad_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2080
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\0819680f9633ccc846b3776cbc382bad_JaffaCakes118.dll
  2⤵
  PID:1956