ca16866859a596365f455afda569a99bc817cee2952c00b8ae4377b71e4f7ef6

Analysis

max time kernel
117s
max time network
123s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
03/07/2024, 02:31

Target

20c7abe34014b021b0fecb7a8fc8e57c_JaffaCakes118.dll
Size

93KB
MD5

20c7abe34014b021b0fecb7a8fc8e57c
SHA1

12b35d91f2910af9a7a9ef9629cd068d7acbb180
SHA256

ca16866859a596365f455afda569a99bc817cee2952c00b8ae4377b71e4f7ef6
SHA512

7b5d8ab4b58baefe99f17c9dddf17f3808e98677e4a51168bcfcdab4615890e04849f434bdcb0b6de62fdce0ddf89a5ea6e8e063efff9411fa617075c4ad4ebe
SSDEEP

768:9eP9h30L3nxMi5POoU29JbRAeP9h30L3nxMi5POoU29JbRAeP9h30L3nxMi5POoZ:9kfwMi5GkfwMi5GkfwMi5

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3020 wrote to memory of 1768	3020	regsvr32.exe	28
PID 3020 wrote to memory of 1768	3020	regsvr32.exe	28
PID 3020 wrote to memory of 1768	3020	regsvr32.exe	28
PID 3020 wrote to memory of 1768	3020	regsvr32.exe	28
PID 3020 wrote to memory of 1768	3020	regsvr32.exe	28
PID 3020 wrote to memory of 1768	3020	regsvr32.exe	28
PID 3020 wrote to memory of 1768	3020	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\20c7abe34014b021b0fecb7a8fc8e57c_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3020
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\20c7abe34014b021b0fecb7a8fc8e57c_JaffaCakes118.dll
  2⤵
  PID:1768

memory/1768-0-0x0000000000170000-0x000000000017D000-memory.dmp

Filesize
52KB

Download