1aba3c877a8bdae0b089fd71b252953866bc127f8da12b8ba49d5ad68241985b

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
03-07-2024 13:42

Target

228cde4a17d10c7efd416c2842bdfe6e_JaffaCakes118.dll
Size

80KB
MD5

228cde4a17d10c7efd416c2842bdfe6e
SHA1

fff40eaf6441a45d152013407cf728c3516de570
SHA256

1aba3c877a8bdae0b089fd71b252953866bc127f8da12b8ba49d5ad68241985b
SHA512

ee42aac1ece9ab95216cd9e15c7ef9a878a2ae060f8ee021561415b3402ca17ef74955c5c72b021d5b7ba9086ab37b7c9ca9e651c188e9d3a750fdf75c776aa9
SSDEEP

1536:prCPwhzE3HsjfmOI6v3PA6cUCRI8PKauv0APCl+RvODAdEjNHwl5UBOv:FrhsHsLTvfaUCG1xvTvRuAejNHGUB2

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2848 wrote to memory of 2912	2848	regsvr32.exe	28
PID 2848 wrote to memory of 2912	2848	regsvr32.exe	28
PID 2848 wrote to memory of 2912	2848	regsvr32.exe	28
PID 2848 wrote to memory of 2912	2848	regsvr32.exe	28
PID 2848 wrote to memory of 2912	2848	regsvr32.exe	28
PID 2848 wrote to memory of 2912	2848	regsvr32.exe	28
PID 2848 wrote to memory of 2912	2848	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\228cde4a17d10c7efd416c2842bdfe6e_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2848
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\228cde4a17d10c7efd416c2842bdfe6e_JaffaCakes118.dll
  2⤵
  PID:2912

memory/2912-0-0x0000000000190000-0x00000000001CF000-memory.dmp

Filesize
252KB

Download