05d190c18a1eeb3d5a92ffccae9df31dc1c5abee5c346f1acd861af11d0c83ed

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
25/06/2024, 07:59

Target

0d4b99d6f108e464786fcf83e8249175_JaffaCakes118.dll
Size

97KB
MD5

0d4b99d6f108e464786fcf83e8249175
SHA1

44eefb2e30517b285618f5a9aba61eb4db38ad59
SHA256

05d190c18a1eeb3d5a92ffccae9df31dc1c5abee5c346f1acd861af11d0c83ed
SHA512

690fc229b3bf379a2a30f89c491dee7e7876ea2b69bc6aada248a9ab3acc86d06bfece372abda5451fd8cf5507bc074e0ca086905923b4cd875552b864c3e466
SSDEEP

1536:NQspD5TNK5fFJvkwf6ZNjGWMhsx5FwYjhaKRPgAEHUT0BDSPStlYJ3F5DNcrMOlx:/BXLVMhsx5FwYF5PgAp2DMelYBFeME

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2844 wrote to memory of 2856	2844	regsvr32.exe	28
PID 2844 wrote to memory of 2856	2844	regsvr32.exe	28
PID 2844 wrote to memory of 2856	2844	regsvr32.exe	28
PID 2844 wrote to memory of 2856	2844	regsvr32.exe	28
PID 2844 wrote to memory of 2856	2844	regsvr32.exe	28
PID 2844 wrote to memory of 2856	2844	regsvr32.exe	28
PID 2844 wrote to memory of 2856	2844	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\0d4b99d6f108e464786fcf83e8249175_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2844
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\0d4b99d6f108e464786fcf83e8249175_JaffaCakes118.dll
  2⤵
  PID:2856