911e2c25096b205b2014167624d29f5fd2be57f1336f6b5be7e1dc2d2f560e0b

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
03-07-2024 09:14

Target

21d2c44dd20f1257962bc6b85b193f0d_JaffaCakes118.dll
Size

97KB
MD5

21d2c44dd20f1257962bc6b85b193f0d
SHA1

d133c28b234f33783ec4c43a3977ed1dfdde6fed
SHA256

911e2c25096b205b2014167624d29f5fd2be57f1336f6b5be7e1dc2d2f560e0b
SHA512

bb6b61214cdf8a7418471969bbb7a3f53b351dd9ebf76fdec86d6a68c5f84bc04ea04045029be8fc506d0714a6dc18625ca0e20293b1b573221f9055871d5172
SSDEEP

1536:NQspD5TNK5fFJvkwf6ZNjGWMhsx5FwYuhaKRPgAEHUT0BDSPStlYJ3F5DNcrMOlx:/BXLVMhsx5FwYW5PgAp2DMelYBFeME

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2016 wrote to memory of 2088	2016	regsvr32.exe	28
PID 2016 wrote to memory of 2088	2016	regsvr32.exe	28
PID 2016 wrote to memory of 2088	2016	regsvr32.exe	28
PID 2016 wrote to memory of 2088	2016	regsvr32.exe	28
PID 2016 wrote to memory of 2088	2016	regsvr32.exe	28
PID 2016 wrote to memory of 2088	2016	regsvr32.exe	28
PID 2016 wrote to memory of 2088	2016	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\21d2c44dd20f1257962bc6b85b193f0d_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2016
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\21d2c44dd20f1257962bc6b85b193f0d_JaffaCakes118.dll
  2⤵
  PID:2088