f55797f046b1b04931b78bb085d18f620fab7a77472c7a571bebd10b1791304a

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
28-06-2024 10:10

Target

19be67e0356a3a292eaccbf41db640bb_JaffaCakes118.dll
Size

69KB
MD5

19be67e0356a3a292eaccbf41db640bb
SHA1

358a93de3b50a306bd61ca0d61caf45fe2449f53
SHA256

f55797f046b1b04931b78bb085d18f620fab7a77472c7a571bebd10b1791304a
SHA512

b927c2783d86850866a7b71410da8d8d326baa2ec945b471eadd95ea88fe3f5991ca239b0ee5cae48feca6ba6f26f336ac61f8cf7472df50dafcf55f49ba47e6
SSDEEP

1536:0d7jipTa3sbm9e5MqwUT1cf9ndgWul5U4wUyDPQRoXktf6:0dvlOcqwN7ylw4RoXkF6

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1420 wrote to memory of 2992	1420	regsvr32.exe	28
PID 1420 wrote to memory of 2992	1420	regsvr32.exe	28
PID 1420 wrote to memory of 2992	1420	regsvr32.exe	28
PID 1420 wrote to memory of 2992	1420	regsvr32.exe	28
PID 1420 wrote to memory of 2992	1420	regsvr32.exe	28
PID 1420 wrote to memory of 2992	1420	regsvr32.exe	28
PID 1420 wrote to memory of 2992	1420	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\19be67e0356a3a292eaccbf41db640bb_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1420
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\19be67e0356a3a292eaccbf41db640bb_JaffaCakes118.dll
  2⤵
  PID:2992

memory/2992-0-0x0000000000270000-0x00000000002B9000-memory.dmp

Filesize
292KB

Download
memory/2992-1-0x0000000000270000-0x00000000002B9000-memory.dmp

Filesize
292KB

Download
memory/2992-2-0x000000000029F000-0x00000000002B1000-memory.dmp

Filesize
72KB

Download