128ae016129741fcb2a6f992001b14e647dfb551045a4576e0dbd9996b293f67

Analysis

max time kernel
118s
max time network
123s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
01/07/2024, 17:38

Target

1be8586b3f39757f07c337dfc369bfb2_JaffaCakes118.dll
Size

80KB
MD5

1be8586b3f39757f07c337dfc369bfb2
SHA1

8db6ab3f8f15ef381282dd7da5a72e510e5cf43a
SHA256

128ae016129741fcb2a6f992001b14e647dfb551045a4576e0dbd9996b293f67
SHA512

e1eeb5c201e8df8dc0ce6a6e89bc18a197984e0a8b837f638b9a434197b8c7b3fd4da4997eacd3353de9902ebc573df023e3296c0376057367e87ef711e45e42
SSDEEP

1536:+c78EEwU6LCmMYG5WXW1fFnqeFs0SzCqqEV+eFXenwGvfogd9MYG0:+q8jv6XWpFnqem0SzXnl9ywGvLX

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2000 wrote to memory of 2400	2000	regsvr32.exe	28
PID 2000 wrote to memory of 2400	2000	regsvr32.exe	28
PID 2000 wrote to memory of 2400	2000	regsvr32.exe	28
PID 2000 wrote to memory of 2400	2000	regsvr32.exe	28
PID 2000 wrote to memory of 2400	2000	regsvr32.exe	28
PID 2000 wrote to memory of 2400	2000	regsvr32.exe	28
PID 2000 wrote to memory of 2400	2000	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\1be8586b3f39757f07c337dfc369bfb2_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2000
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\1be8586b3f39757f07c337dfc369bfb2_JaffaCakes118.dll
  2⤵
  PID:2400

memory/2400-0-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2400-1-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download