487e320e7d105840a3e50ba2d6d73d7b7ecafb3e540e00b1a437294c59833984

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
27/06/2024, 19:34

Target

1743de6e754ce13de98c9cd30c322050_JaffaCakes118.dll
Size

40KB
MD5

1743de6e754ce13de98c9cd30c322050
SHA1

9354ba7e870873d3839b3eaf2c29bef3984f8ba7
SHA256

487e320e7d105840a3e50ba2d6d73d7b7ecafb3e540e00b1a437294c59833984
SHA512

d0d8ea995444b48cd9324b7042cbfbee80f476e467f5ed4402b52c5f16a53a75f21e66bf483cec788e47afbfac7c980742713da72d2b0cff7b8de3f60b92f8da
SSDEEP

768:M5TTnS/54xjmf0TYHok5Hx8dvXi1WUXkaBiSxr2vOKwciHGXso:MtnS/5ESUiLriSxr22u

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2860 wrote to memory of 2920	2860	regsvr32.exe	28
PID 2860 wrote to memory of 2920	2860	regsvr32.exe	28
PID 2860 wrote to memory of 2920	2860	regsvr32.exe	28
PID 2860 wrote to memory of 2920	2860	regsvr32.exe	28
PID 2860 wrote to memory of 2920	2860	regsvr32.exe	28
PID 2860 wrote to memory of 2920	2860	regsvr32.exe	28
PID 2860 wrote to memory of 2920	2860	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\1743de6e754ce13de98c9cd30c322050_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2860
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\1743de6e754ce13de98c9cd30c322050_JaffaCakes118.dll
  2⤵
  PID:2920