ed02e7bd9b56f9736c012d55347484c082d8c190d5585ca37c7f5de45c83fcdc

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
25/06/2024, 07:51

Target

0d45ada7be38fb1ba64a47890991a70c_JaffaCakes118.dll
Size

82KB
MD5

0d45ada7be38fb1ba64a47890991a70c
SHA1

54c20df67b38bca410fad83ef28027276368866e
SHA256

ed02e7bd9b56f9736c012d55347484c082d8c190d5585ca37c7f5de45c83fcdc
SHA512

28fe54036df8fc7f885ec7bd910293c9c2c252cb15a9f645eb5fd3470a8800c3b1cd761025a6ba003a2920d05672652b616546ef7be33a214a442deec0757443
SSDEEP

1536:MmvjcUPv8ALMLByuV8dGled+XRdRnx8XnNWtkh1QuVrDx:RjbsQMb+G8+1nxONWt3uV/x

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1960 wrote to memory of 2520	1960	regsvr32.exe	28
PID 1960 wrote to memory of 2520	1960	regsvr32.exe	28
PID 1960 wrote to memory of 2520	1960	regsvr32.exe	28
PID 1960 wrote to memory of 2520	1960	regsvr32.exe	28
PID 1960 wrote to memory of 2520	1960	regsvr32.exe	28
PID 1960 wrote to memory of 2520	1960	regsvr32.exe	28
PID 1960 wrote to memory of 2520	1960	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\0d45ada7be38fb1ba64a47890991a70c_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1960
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\0d45ada7be38fb1ba64a47890991a70c_JaffaCakes118.dll
  2⤵
  PID:2520

memory/2520-0-0x00000000008F0000-0x000000000092E000-memory.dmp

Filesize
248KB

Download