104a865fe4cfbe8b963cff5dbe89f208cd561d9868eab08c0129c9099be74c77

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
04/07/2024, 06:37

Target

24f7ce9e356435304776b2bf4160a58e_JaffaCakes118.dll
Size

124KB
MD5

24f7ce9e356435304776b2bf4160a58e
SHA1

7926bbdda033fec0a462ed4987b1cc4ed5cafe92
SHA256

104a865fe4cfbe8b963cff5dbe89f208cd561d9868eab08c0129c9099be74c77
SHA512

260e6d0c6683e04e4dd16b3f06b5add7b7b652046c6376b20b761e1cba6c96764b0f2c215fe010eafea2621461afa54d9ac785d9d5db32aa4cc3e4e08e8d6efc
SSDEEP

3072:eUXOt+qvmnLYueuQW8wB0AjVdSnPM1NDhckHKHD:b+x+LYueznwaASPSNNTKH

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2060 wrote to memory of 1756	2060	regsvr32.exe	28
PID 2060 wrote to memory of 1756	2060	regsvr32.exe	28
PID 2060 wrote to memory of 1756	2060	regsvr32.exe	28
PID 2060 wrote to memory of 1756	2060	regsvr32.exe	28
PID 2060 wrote to memory of 1756	2060	regsvr32.exe	28
PID 2060 wrote to memory of 1756	2060	regsvr32.exe	28
PID 2060 wrote to memory of 1756	2060	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\24f7ce9e356435304776b2bf4160a58e_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2060
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\24f7ce9e356435304776b2bf4160a58e_JaffaCakes118.dll
  2⤵
  PID:1756

memory/1756-0-0x00000000004B0000-0x0000000000501000-memory.dmp

Filesize
324KB

Download
memory/1756-2-0x00000000004E1000-0x0000000000500000-memory.dmp

Filesize
124KB

Download
memory/1756-1-0x00000000004B0000-0x0000000000501000-memory.dmp

Filesize
324KB

Download