05777e177fc4acca2d8347f7aa7b2ea0e17d4837501c17e464e208228a09b2c4

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
06/07/2024, 21:11

Target

295f06d92f4107f271ed7061f3aaeaf7_JaffaCakes118.dll
Size

29KB
MD5

295f06d92f4107f271ed7061f3aaeaf7
SHA1

0e984ab75ba213de12091a620b1795e44f66680c
SHA256

05777e177fc4acca2d8347f7aa7b2ea0e17d4837501c17e464e208228a09b2c4
SHA512

32ba4d88ac393a3ff8771dd989c0dd7a54945599df09ff3ee2da9c417670390839feee0688633bdddae5c98bb24fc5a08a3e7f6d38e5d7e67da613f4adde46a7
SSDEEP

384:30AHxUSCqujBwKnGQ6VIE4R4fKCUYyxb4REGbMP5KriKMCqZzAzdRNQMJXvkC4z5:lKSCquFw0GQu2R4fpbMxSiGldRNdB+5

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1596 wrote to memory of 2060	1596	regsvr32.exe	30
PID 1596 wrote to memory of 2060	1596	regsvr32.exe	30
PID 1596 wrote to memory of 2060	1596	regsvr32.exe	30
PID 1596 wrote to memory of 2060	1596	regsvr32.exe	30
PID 1596 wrote to memory of 2060	1596	regsvr32.exe	30
PID 1596 wrote to memory of 2060	1596	regsvr32.exe	30
PID 1596 wrote to memory of 2060	1596	regsvr32.exe	30

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\295f06d92f4107f271ed7061f3aaeaf7_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1596
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\295f06d92f4107f271ed7061f3aaeaf7_JaffaCakes118.dll
  2⤵
  PID:2060

memory/2060-0-0x00000000000C0000-0x00000000000CD000-memory.dmp

Filesize
52KB

Download