Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
04/07/2024, 04:15
Behavioral task
behavioral1
Sample
24991f1283abc05af04529f240dfc087_JaffaCakes118.dll
Resource
win7-20240508-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
24991f1283abc05af04529f240dfc087_JaffaCakes118.dll
Resource
win10v2004-20240508-en
3 signatures
150 seconds
General
-
Target
24991f1283abc05af04529f240dfc087_JaffaCakes118.dll
-
Size
33KB
-
MD5
24991f1283abc05af04529f240dfc087
-
SHA1
1c9e9c2545fdb805d7cdbaf5c9d656399d793838
-
SHA256
546e72e2cde9b9e386debef88437276fbf248c459de04429c5b55b5b0c4f711b
-
SHA512
619829a931ab44c486599ad1b7d53055382a12f52d0d477dc1de9ef072c622209c411356c266c1e5a258283fc47d2e9c16e6901c5a5617e18740d8d4054309c0
-
SSDEEP
768:cKSoqu380GQplBoJaeR1q7K+3XQeN4W4M49wk/T2h:Uoqu380GQplBoQwIL3XQeB4Z9wf
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2240 wrote to memory of 1684 2240 regsvr32.exe 28 PID 2240 wrote to memory of 1684 2240 regsvr32.exe 28 PID 2240 wrote to memory of 1684 2240 regsvr32.exe 28 PID 2240 wrote to memory of 1684 2240 regsvr32.exe 28 PID 2240 wrote to memory of 1684 2240 regsvr32.exe 28 PID 2240 wrote to memory of 1684 2240 regsvr32.exe 28 PID 2240 wrote to memory of 1684 2240 regsvr32.exe 28
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\24991f1283abc05af04529f240dfc087_JaffaCakes118.dll1⤵
- Suspicious use of WriteProcessMemory
PID:2240 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\24991f1283abc05af04529f240dfc087_JaffaCakes118.dll2⤵PID:1684
-