1b75f4302c26f6432bc8b77bcaf7417a58ac40a6b37ddc39b2e5ba084dc07394

Analysis

max time kernel
14s
max time network
19s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
06/07/2024, 08:00

Target

27d2089307cd37ca2e70270586f28eab_JaffaCakes118.dll
Size

100KB
MD5

27d2089307cd37ca2e70270586f28eab
SHA1

50e3de39e80bedfa08585b10edd1439db7d6471a
SHA256

1b75f4302c26f6432bc8b77bcaf7417a58ac40a6b37ddc39b2e5ba084dc07394
SHA512

f06f3c3b4f176b093d774fbfbad1c896a2a312cfad67f678dbe30c682fff3907a705efbd0694d660ad1898008751073e12b5bd641c0e9c4d6f940475b06b8f7f
SSDEEP

1536:YMqzW7JoS7qxgY96riqT2KazWkokkkkkkotV74wooR9qbcdy:Y5OK1bzWkokkkkkkcVUwooRp

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2296 wrote to memory of 2316	2296	regsvr32.exe	29
PID 2296 wrote to memory of 2316	2296	regsvr32.exe	29
PID 2296 wrote to memory of 2316	2296	regsvr32.exe	29
PID 2296 wrote to memory of 2316	2296	regsvr32.exe	29
PID 2296 wrote to memory of 2316	2296	regsvr32.exe	29
PID 2296 wrote to memory of 2316	2296	regsvr32.exe	29
PID 2296 wrote to memory of 2316	2296	regsvr32.exe	29

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\27d2089307cd37ca2e70270586f28eab_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2296
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\27d2089307cd37ca2e70270586f28eab_JaffaCakes118.dll
  2⤵
  PID:2316

memory/2316-0-0x0000000010000000-0x0000000010019000-memory.dmp

Filesize
100KB

Download