e28d9d9a177c5ec7cba3b8fbf9bb64cba6b7efda313816cb699e4f83ab01b9fc

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
01-07-2024 11:03

Target

1b0b76cbb7e6b93ded001bdfd7cf2971_JaffaCakes118.dll
Size

15KB
MD5

1b0b76cbb7e6b93ded001bdfd7cf2971
SHA1

e07b4da8b66a625f6419b3d4deada050e11b17f9
SHA256

e28d9d9a177c5ec7cba3b8fbf9bb64cba6b7efda313816cb699e4f83ab01b9fc
SHA512

99eb0221b1085942af53ac356cf97e04a5127793ae62d73d3fb33952c0dc10afd155721b1944d96f5f31e1fbeb023304c7715d66d2375268ac2d69c80a579d20
SSDEEP

192:nyLyO98cK/hZPNj3At1QQxdvk/yazwyanPYMmYjKyEfcd6KbIomGJW21xRKbHHyN:4KL/hZyLMzkyjEKad6qI7G86rNQi9

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1176 wrote to memory of 888	1176	regsvr32.exe	28
PID 1176 wrote to memory of 888	1176	regsvr32.exe	28
PID 1176 wrote to memory of 888	1176	regsvr32.exe	28
PID 1176 wrote to memory of 888	1176	regsvr32.exe	28
PID 1176 wrote to memory of 888	1176	regsvr32.exe	28
PID 1176 wrote to memory of 888	1176	regsvr32.exe	28
PID 1176 wrote to memory of 888	1176	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\1b0b76cbb7e6b93ded001bdfd7cf2971_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1176
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\1b0b76cbb7e6b93ded001bdfd7cf2971_JaffaCakes118.dll
  2⤵
  PID:888