28a63550754a289ec0a368f7ae1076dbb861ea1daa4cf194ede79fb91f0a66d3

Analysis

max time kernel
119s
max time network
119s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
28/06/2024, 13:27

Target

1a4ba01e5994361c80443370d7a6d40a_JaffaCakes118.dll
Size

56KB
MD5

1a4ba01e5994361c80443370d7a6d40a
SHA1

69caefbb1f0dc35c3dfebf73e59d1d8f2e61240e
SHA256

28a63550754a289ec0a368f7ae1076dbb861ea1daa4cf194ede79fb91f0a66d3
SHA512

d8eec87b8603510cd5698551ee1063eec3d72141d099c1a4e490d71d4dc1085a2b8f61c4abbfe2a061bd902b5f7a44ad5a95975c99fe5f69b449bd2e785fd99c
SSDEEP

768:xbIYz7tJhGuiRCRyIwfMhXmm1Lmaon4ZJVwlCdf06No2s:xbIYHxGuTRy1fMh1L9+AVNdRfs

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2432 wrote to memory of 2176	2432	regsvr32.exe	28
PID 2432 wrote to memory of 2176	2432	regsvr32.exe	28
PID 2432 wrote to memory of 2176	2432	regsvr32.exe	28
PID 2432 wrote to memory of 2176	2432	regsvr32.exe	28
PID 2432 wrote to memory of 2176	2432	regsvr32.exe	28
PID 2432 wrote to memory of 2176	2432	regsvr32.exe	28
PID 2432 wrote to memory of 2176	2432	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\1a4ba01e5994361c80443370d7a6d40a_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2432
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\1a4ba01e5994361c80443370d7a6d40a_JaffaCakes118.dll
  2⤵
  PID:2176