903a7211fecf9e698f7c494d4274ca23e1a311a2fbb4818bb0821b0d3f9a3e5e

Analysis

max time kernel
119s
max time network
119s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
28-06-2024 03:21

Target

1899a19658051018c294c827db8ee045_JaffaCakes118.dll
Size

73KB
MD5

1899a19658051018c294c827db8ee045
SHA1

af34b64b23bef9d36ce3680b0e5603e6eea3efa3
SHA256

903a7211fecf9e698f7c494d4274ca23e1a311a2fbb4818bb0821b0d3f9a3e5e
SHA512

3bb28a97d3a759625b83abea09e8009feaabe8ae8e3ca89acd026c758f0bc0fc224cdf60a09b451bf75a2fb37df251177d45adb9de7deb73a7621e82931fc1ff
SSDEEP

1536:p7A74ZIjAljg3Ngps6gKcWY+bUntygQvRVKlSt/tIVmCFwAv:p7A75jcjg3N4/gKM+bUtaLKatIVmKwA

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2820 wrote to memory of 1592	2820	regsvr32.exe	28
PID 2820 wrote to memory of 1592	2820	regsvr32.exe	28
PID 2820 wrote to memory of 1592	2820	regsvr32.exe	28
PID 2820 wrote to memory of 1592	2820	regsvr32.exe	28
PID 2820 wrote to memory of 1592	2820	regsvr32.exe	28
PID 2820 wrote to memory of 1592	2820	regsvr32.exe	28
PID 2820 wrote to memory of 1592	2820	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\1899a19658051018c294c827db8ee045_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2820
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\1899a19658051018c294c827db8ee045_JaffaCakes118.dll
  2⤵
  PID:1592

memory/1592-0-0x0000000010000000-0x0000000010050000-memory.dmp

Filesize
320KB

Download