c3964e40f72ac8425bcccbc05e73d0e620d88ce921ab345dd735b4de68a10870

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
25/06/2024, 13:11

Target

0e33afc2487a1fa229c92bb136d8d436_JaffaCakes118.dll
Size

70KB
MD5

0e33afc2487a1fa229c92bb136d8d436
SHA1

5067d531ebe1822981361cc078c6cf199f2f9ea9
SHA256

c3964e40f72ac8425bcccbc05e73d0e620d88ce921ab345dd735b4de68a10870
SHA512

1817fa7667a53a2c8338c45159e658bcbdf12a4865f099bb4c947a6bff7271d170b1ff21b56fddb57686a51a36b1116a5d0cfb3f8fcd49c52de9f68af5081773
SSDEEP

1536:1aT/Cjc03U5DXUAVAyJu4e4eUV6KPNF0lv9ePKcvBerm:cKjc03UE4e6lPNFgv90vBerm

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1728 wrote to memory of 2248	1728	regsvr32.exe	28
PID 1728 wrote to memory of 2248	1728	regsvr32.exe	28
PID 1728 wrote to memory of 2248	1728	regsvr32.exe	28
PID 1728 wrote to memory of 2248	1728	regsvr32.exe	28
PID 1728 wrote to memory of 2248	1728	regsvr32.exe	28
PID 1728 wrote to memory of 2248	1728	regsvr32.exe	28
PID 1728 wrote to memory of 2248	1728	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\0e33afc2487a1fa229c92bb136d8d436_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1728
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\0e33afc2487a1fa229c92bb136d8d436_JaffaCakes118.dll
  2⤵
  PID:2248