c3ef5ed4f75091f560de61aa6c4b9613d4d00751032627d809f4467dfbacc844

Analysis

max time kernel
122s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
25-06-2024 22:23

Target

0fbee04a676c2b93de107ebcb16f7c22_JaffaCakes118.dll
Size

88KB
MD5

0fbee04a676c2b93de107ebcb16f7c22
SHA1

e252adfbae3ce37cebd948a55242585a298319e0
SHA256

c3ef5ed4f75091f560de61aa6c4b9613d4d00751032627d809f4467dfbacc844
SHA512

b7dddff515cce48c967bd211e2a06f351ccb9b7b6fd1298bbd916e2df59a498ab67281ac5fc35e19b49cb72dd042d8f5f33613dd328a80b0d6569419cf97982c
SSDEEP

1536:CXMpPolpi78UlL5X2O6p2HyVI3maBFFloMFk9lxg9BNXh09Lj6sSErOKM:CXMholpi78sLb6p1I3XBJoMSxgfNR0t+

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1948 wrote to memory of 2412	1948	regsvr32.exe	28
PID 1948 wrote to memory of 2412	1948	regsvr32.exe	28
PID 1948 wrote to memory of 2412	1948	regsvr32.exe	28
PID 1948 wrote to memory of 2412	1948	regsvr32.exe	28
PID 1948 wrote to memory of 2412	1948	regsvr32.exe	28
PID 1948 wrote to memory of 2412	1948	regsvr32.exe	28
PID 1948 wrote to memory of 2412	1948	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\0fbee04a676c2b93de107ebcb16f7c22_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1948
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\0fbee04a676c2b93de107ebcb16f7c22_JaffaCakes118.dll
  2⤵
  PID:2412

memory/2412-0-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download