0bb1bf5da9bd20586e5630f2b11c87c209038511cd342ce13d33fb7abd296cfe

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
27/06/2024, 08:22

Target

154e597cf6616142f0c5e47c51c63a5f_JaffaCakes118.dll
Size

220KB
MD5

154e597cf6616142f0c5e47c51c63a5f
SHA1

96fa6944b31157e961bcadf8d24d89fd85ceb6a4
SHA256

0bb1bf5da9bd20586e5630f2b11c87c209038511cd342ce13d33fb7abd296cfe
SHA512

0074f75ea64616eb7a9aeeb6f4e2217e9d0f9ed4aaa94e94fd247ca9015dc18f647edd9c2d266c039cc6339d998da5651a5dd93d8813d6dccad23e8056456fc8
SSDEEP

3072:CjlKTiGjlKTiGjlKTiGjlKTiGjlKTiGjlKTiGjlKTi:elKTblKTblKTblKTblKTblKTblKT

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3036 wrote to memory of 2892	3036	regsvr32.exe	28
PID 3036 wrote to memory of 2892	3036	regsvr32.exe	28
PID 3036 wrote to memory of 2892	3036	regsvr32.exe	28
PID 3036 wrote to memory of 2892	3036	regsvr32.exe	28
PID 3036 wrote to memory of 2892	3036	regsvr32.exe	28
PID 3036 wrote to memory of 2892	3036	regsvr32.exe	28
PID 3036 wrote to memory of 2892	3036	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\154e597cf6616142f0c5e47c51c63a5f_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3036
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\154e597cf6616142f0c5e47c51c63a5f_JaffaCakes118.dll
  2⤵
  PID:2892

memory/2892-0-0x00000000000D0000-0x00000000000DD000-memory.dmp

Filesize
52KB

Download