1f8e0ef4cf1cacfd2525a798807c1dd23152a42a4091793c4eb3a3b01dba330b

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
06-07-2024 08:31

Target

27e8385a52d98508c6a0133c72c7ce15_JaffaCakes118.dll
Size

117KB
MD5

27e8385a52d98508c6a0133c72c7ce15
SHA1

9c02275df075c8647e2285aa685b753cb117c0b6
SHA256

1f8e0ef4cf1cacfd2525a798807c1dd23152a42a4091793c4eb3a3b01dba330b
SHA512

525d2c5ce8a8f6525cc081dba827ef9d46b37c152181a5728b9e780702645a74495b890b584dabe2bcc1e4a62198c217e689778c92b7f301621f20bc28bc10e6
SSDEEP

3072:TcCP8l8VutkQPFyQQz70DXdbRLTvmM24UxyV:TXUleuyQPFQz7CRL7mMYxyV

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2444 wrote to memory of 1984	2444	regsvr32.exe	30
PID 2444 wrote to memory of 1984	2444	regsvr32.exe	30
PID 2444 wrote to memory of 1984	2444	regsvr32.exe	30
PID 2444 wrote to memory of 1984	2444	regsvr32.exe	30
PID 2444 wrote to memory of 1984	2444	regsvr32.exe	30
PID 2444 wrote to memory of 1984	2444	regsvr32.exe	30
PID 2444 wrote to memory of 1984	2444	regsvr32.exe	30

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\27e8385a52d98508c6a0133c72c7ce15_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2444
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\27e8385a52d98508c6a0133c72c7ce15_JaffaCakes118.dll
  2⤵
  PID:1984

memory/1984-0-0x00000000001D0000-0x0000000000220000-memory.dmp

Filesize
320KB

Download