b035ca09482c9d20887df2056f66e66f7294365e6b7d1dd0445dd1aa74a51673

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
27-06-2024 15:49

Target

1696391d4458db55fbcd4b4c2a741ba4_JaffaCakes118.dll
Size

160KB
MD5

1696391d4458db55fbcd4b4c2a741ba4
SHA1

3809bf2112e0f776a2bf8579fa450bdface00a76
SHA256

b035ca09482c9d20887df2056f66e66f7294365e6b7d1dd0445dd1aa74a51673
SHA512

0da14ecb0b76782f658e75db13b9adc4ff95c58741358d969bb6ee18f18a6c3f679e8ffb702afbeb97dfc7d3a740396a56e4fed154545f00a95a96df03ad262f
SSDEEP

3072:umCIHpnIHpnIHpnIHpnIHpnIHpnIHpnIHpnIHpnIHpu:Bgggggggggu

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1688 wrote to memory of 1712	1688	regsvr32.exe	28
PID 1688 wrote to memory of 1712	1688	regsvr32.exe	28
PID 1688 wrote to memory of 1712	1688	regsvr32.exe	28
PID 1688 wrote to memory of 1712	1688	regsvr32.exe	28
PID 1688 wrote to memory of 1712	1688	regsvr32.exe	28
PID 1688 wrote to memory of 1712	1688	regsvr32.exe	28
PID 1688 wrote to memory of 1712	1688	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\1696391d4458db55fbcd4b4c2a741ba4_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1688
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\1696391d4458db55fbcd4b4c2a741ba4_JaffaCakes118.dll
  2⤵
  PID:1712

memory/1712-0-0x0000000000360000-0x0000000000379000-memory.dmp

Filesize
100KB

Download