962078f31de7f21dff03ff806d3fb841f34a9546007509ea672a219e8cf8f2fd

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
03/07/2024, 12:45

Target

226c83a0a5102b3582a3adfe729d4b63_JaffaCakes118.dll
Size

165KB
MD5

226c83a0a5102b3582a3adfe729d4b63
SHA1

96eff2ddde25f29f5072f2754855583262271d83
SHA256

962078f31de7f21dff03ff806d3fb841f34a9546007509ea672a219e8cf8f2fd
SHA512

48fcb59ed462e046f376aeb2a6b6e95a0d57d228e128a63df90066d8f1d0233eeaae0639e5f14f7bc7be01be75b3d88d96bc635e4cdefa55bf1da0be0484e393
SSDEEP

3072:B2FBlUYXTIV64YXTIV64YXTIV64YXTIV64YXTIV64YXTIV64YXTIV64YXTIV64Yn:ch7LLLLLLLLL3

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2244 wrote to memory of 2824	2244	regsvr32.exe	28
PID 2244 wrote to memory of 2824	2244	regsvr32.exe	28
PID 2244 wrote to memory of 2824	2244	regsvr32.exe	28
PID 2244 wrote to memory of 2824	2244	regsvr32.exe	28
PID 2244 wrote to memory of 2824	2244	regsvr32.exe	28
PID 2244 wrote to memory of 2824	2244	regsvr32.exe	28
PID 2244 wrote to memory of 2824	2244	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\226c83a0a5102b3582a3adfe729d4b63_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2244
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\226c83a0a5102b3582a3adfe729d4b63_JaffaCakes118.dll
  2⤵
  PID:2824