9c76b6a50f88848dbca1529c90dd15ca470cc74a0c4f570feca73ff1e086a6ce

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
01-07-2024 12:16

Target

1b45059779f239c4e9d99cf27e5515d7_JaffaCakes118.dll
Size

121KB
MD5

1b45059779f239c4e9d99cf27e5515d7
SHA1

221111745eee5d31dea463cd07c1ea26551fcfb5
SHA256

9c76b6a50f88848dbca1529c90dd15ca470cc74a0c4f570feca73ff1e086a6ce
SHA512

8e95e2e3ab877b3785e8e63aa5b2d1233ff431acc6e47b0fa27ad4efb5353ab704e15c901346659b22adde7320bad89b22c3977ee359525b997b36912d16a551
SSDEEP

1536:T1IF3ONWJyyhmVgB7GDMeGA+1nVBDMJcOgUGvtbq6a7C2:T1IFeNWbhwgB7sMeGA+/hMJcOgUG1bYz

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2160 wrote to memory of 2168	2160	regsvr32.exe	28
PID 2160 wrote to memory of 2168	2160	regsvr32.exe	28
PID 2160 wrote to memory of 2168	2160	regsvr32.exe	28
PID 2160 wrote to memory of 2168	2160	regsvr32.exe	28
PID 2160 wrote to memory of 2168	2160	regsvr32.exe	28
PID 2160 wrote to memory of 2168	2160	regsvr32.exe	28
PID 2160 wrote to memory of 2168	2160	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\1b45059779f239c4e9d99cf27e5515d7_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2160
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\1b45059779f239c4e9d99cf27e5515d7_JaffaCakes118.dll
  2⤵
  PID:2168