96c07e39cd654a7bbbae2aed0f3badd872d030d96fcd3b6635500e8ba5ab237b

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
04/07/2024, 09:50

Target

2581c14068315c6a67efdd05af60c6e9_JaffaCakes118.dll
Size

102KB
MD5

2581c14068315c6a67efdd05af60c6e9
SHA1

197589a1d6f4afe5230e82b646eb292433a5b14b
SHA256

96c07e39cd654a7bbbae2aed0f3badd872d030d96fcd3b6635500e8ba5ab237b
SHA512

c5db1a1ed0aed9f3019b77e3ac222fa6eaf5f5e8db9b473000bb9909a585add338f71b1c50c7f7d76158d743b853d45224eb36ebf43f3665f1b13ca0abfc1743
SSDEEP

3072:JGl6VMPBJLDMrsnhPSELX644nOo+iywQoE7j:ElTpdM+aQ6hTUo

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2060 wrote to memory of 1432	2060	regsvr32.exe	28
PID 2060 wrote to memory of 1432	2060	regsvr32.exe	28
PID 2060 wrote to memory of 1432	2060	regsvr32.exe	28
PID 2060 wrote to memory of 1432	2060	regsvr32.exe	28
PID 2060 wrote to memory of 1432	2060	regsvr32.exe	28
PID 2060 wrote to memory of 1432	2060	regsvr32.exe	28
PID 2060 wrote to memory of 1432	2060	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\2581c14068315c6a67efdd05af60c6e9_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2060
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\2581c14068315c6a67efdd05af60c6e9_JaffaCakes118.dll
  2⤵
  PID:1432