fae3d60599be1d9af85caa1799cc5d4f39cd8771f1cfc4f7a3c74ce39608c803

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
27-06-2024 03:47

Target

14921f7e9b6a1e22c6a2d5621142684d_JaffaCakes118.dll
Size

11KB
MD5

14921f7e9b6a1e22c6a2d5621142684d
SHA1

a1cd6514b681f15ea6e8ae9ed3f85aa48a23430c
SHA256

fae3d60599be1d9af85caa1799cc5d4f39cd8771f1cfc4f7a3c74ce39608c803
SHA512

4f99867cb9412d50d1fa2a1ccd2a98a221a1bf21960f8e47172af9f9bb48fe831434e6333fa4108185164486709365ad251369e09c38813f74263c33716b294c
SSDEEP

192:m7czVW8mcWecziQnRSHbxjYVm7U+BTOiRdDDEt/5587455271kgUwukA1:8cZW8mcWn8VYVx+xwt/558c55YaX

Score

8^/10

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3040 wrote to memory of 2112	3040	regsvr32.exe	28
PID 3040 wrote to memory of 2112	3040	regsvr32.exe	28
PID 3040 wrote to memory of 2112	3040	regsvr32.exe	28
PID 3040 wrote to memory of 2112	3040	regsvr32.exe	28
PID 3040 wrote to memory of 2112	3040	regsvr32.exe	28
PID 3040 wrote to memory of 2112	3040	regsvr32.exe	28
PID 3040 wrote to memory of 2112	3040	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\14921f7e9b6a1e22c6a2d5621142684d_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3040
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\14921f7e9b6a1e22c6a2d5621142684d_JaffaCakes118.dll
  2⤵
  - Drops file in Drivers directory
  PID:2112