8a5a9d4d34af54e59b26e41cf21519d5ec3865417ab71b78dce1c7f1f86ccf0b

Analysis

max time kernel
121s
max time network
126s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
25/06/2024, 16:15

Target

0eb85afb4d212d45a10dd9429dd3f216_JaffaCakes118.dll
Size

44KB
MD5

0eb85afb4d212d45a10dd9429dd3f216
SHA1

7b35bc049b2263b89c139d0317f74f76e158c5ed
SHA256

8a5a9d4d34af54e59b26e41cf21519d5ec3865417ab71b78dce1c7f1f86ccf0b
SHA512

a9c87c9ef2fe1d94ba3e308f6a8bcb847663cbe5f2da2b0d3296ce82c1217ae3215ad0e1f9f154d9bdb4b7627a2ab2d4aeb2864706317bc0b51c43d0d95717b7
SSDEEP

768:CvA+bRH7LLxEmDk+30KwP4pkavI83MgLa1KLBNp:CvNpCmYxvLG3NLaQdNp

Score

1^/10

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2572	Rundll32.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2572	Rundll32.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2232 wrote to memory of 1432	2232	regsvr32.exe	28
PID 2232 wrote to memory of 1432	2232	regsvr32.exe	28
PID 2232 wrote to memory of 1432	2232	regsvr32.exe	28
PID 2232 wrote to memory of 1432	2232	regsvr32.exe	28
PID 2232 wrote to memory of 1432	2232	regsvr32.exe	28
PID 2232 wrote to memory of 1432	2232	regsvr32.exe	28
PID 2232 wrote to memory of 1432	2232	regsvr32.exe	28
PID 1432 wrote to memory of 2572	1432	regsvr32.exe	29
PID 1432 wrote to memory of 2572	1432	regsvr32.exe	29
PID 1432 wrote to memory of 2572	1432	regsvr32.exe	29
PID 1432 wrote to memory of 2572	1432	regsvr32.exe	29
PID 1432 wrote to memory of 2572	1432	regsvr32.exe	29
PID 1432 wrote to memory of 2572	1432	regsvr32.exe	29
PID 1432 wrote to memory of 2572	1432	regsvr32.exe	29

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\0eb85afb4d212d45a10dd9429dd3f216_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2232
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\0eb85afb4d212d45a10dd9429dd3f216_JaffaCakes118.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1432
- - C:\Windows\SysWOW64\Rundll32.exe
    C:\Windows\system32\Rundll32.exe C:\Users\Admin\AppData\Local\Temp\0eb85afb4d212d45a10dd9429dd3f216_JaffaCakes118.dll,DllUnregisterServer
    3⤵
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    PID:2572