5408306438afc7351ee724916ad75410a90843f00ee89a37bde4957af9e329f1

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
28/06/2024, 01:27

Target

1849b25e00a48db7baa620f828833f87_JaffaCakes118.dll
Size

130KB
MD5

1849b25e00a48db7baa620f828833f87
SHA1

abe8ec61e56566734c3488cb536c1f02555a1b56
SHA256

5408306438afc7351ee724916ad75410a90843f00ee89a37bde4957af9e329f1
SHA512

a505f051388902757050042f22ce6b50d1ac3f02e99157318e7d99f63f94e0904cb055ef342c2eada53a3a8646198f4aec036340203a5b4e9ece0031a99a646a
SSDEEP

3072:ri8lbcJ4fjYmvqDZltFZY2WuJ0ebMf8Zx+bxHkHboN2:rlbc+MPFZWuJ0eblxMiS2

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1732 wrote to memory of 2088	1732	regsvr32.exe	28
PID 1732 wrote to memory of 2088	1732	regsvr32.exe	28
PID 1732 wrote to memory of 2088	1732	regsvr32.exe	28
PID 1732 wrote to memory of 2088	1732	regsvr32.exe	28
PID 1732 wrote to memory of 2088	1732	regsvr32.exe	28
PID 1732 wrote to memory of 2088	1732	regsvr32.exe	28
PID 1732 wrote to memory of 2088	1732	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\1849b25e00a48db7baa620f828833f87_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1732
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\1849b25e00a48db7baa620f828833f87_JaffaCakes118.dll
  2⤵
  PID:2088

memory/2088-0-0x0000000000200000-0x0000000000270000-memory.dmp

Filesize
448KB

Download
memory/2088-2-0x0000000000200000-0x0000000000270000-memory.dmp

Filesize
448KB

Download
memory/2088-1-0x0000000000200000-0x0000000000270000-memory.dmp

Filesize
448KB

Download