64d2a60965716cd1cbb4a0109acc7aa8eb779e23e1fc1279713c3ca9344567e2

Analysis

max time kernel
120s
max time network
126s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
28/06/2024, 01:08

Target

183b44a20bea2a668a49fc957ddefc52_JaffaCakes118.dll
Size

44KB
MD5

183b44a20bea2a668a49fc957ddefc52
SHA1

a57491f54369d52401f8d83158a4335236b3648a
SHA256

64d2a60965716cd1cbb4a0109acc7aa8eb779e23e1fc1279713c3ca9344567e2
SHA512

e5ebf829664a591e7dbd96989d2ab2c58e047addea52da2e340d1df83de93711650750ebdd781c527eef106b4a570230991f5bbce3ba7efd9fd44df8feec56ea
SSDEEP

768:GOsSTVimetB2WNJ3CRpkavO47iSFZjQ9gLa1D:TT5et1N78OW/La9

Score

1^/10

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1728	Rundll32.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1728	Rundll32.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2444 wrote to memory of 1272	2444	regsvr32.exe	28
PID 2444 wrote to memory of 1272	2444	regsvr32.exe	28
PID 2444 wrote to memory of 1272	2444	regsvr32.exe	28
PID 2444 wrote to memory of 1272	2444	regsvr32.exe	28
PID 2444 wrote to memory of 1272	2444	regsvr32.exe	28
PID 2444 wrote to memory of 1272	2444	regsvr32.exe	28
PID 2444 wrote to memory of 1272	2444	regsvr32.exe	28
PID 1272 wrote to memory of 1728	1272	regsvr32.exe	29
PID 1272 wrote to memory of 1728	1272	regsvr32.exe	29
PID 1272 wrote to memory of 1728	1272	regsvr32.exe	29
PID 1272 wrote to memory of 1728	1272	regsvr32.exe	29
PID 1272 wrote to memory of 1728	1272	regsvr32.exe	29
PID 1272 wrote to memory of 1728	1272	regsvr32.exe	29
PID 1272 wrote to memory of 1728	1272	regsvr32.exe	29

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\183b44a20bea2a668a49fc957ddefc52_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2444
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\183b44a20bea2a668a49fc957ddefc52_JaffaCakes118.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1272
- - C:\Windows\SysWOW64\Rundll32.exe
    C:\Windows\system32\Rundll32.exe C:\Users\Admin\AppData\Local\Temp\183b44a20bea2a668a49fc957ddefc52_JaffaCakes118.dll,DllUnregisterServer
    3⤵
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    PID:1728