c133c8ce5b03c483fae2695ec0e5f5b2de6f90572cdeb09a1b9ddaf6d6904dbe

Analysis

max time kernel
119s
max time network
128s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
07-07-2024 23:24

Target

2a27e5b1c1369790cba00c00447bfc2b_JaffaCakes118.dll
Size

828KB
MD5

2a27e5b1c1369790cba00c00447bfc2b
SHA1

c07bf9cdf2f06610aafc35d77efa6dc442a9389d
SHA256

c133c8ce5b03c483fae2695ec0e5f5b2de6f90572cdeb09a1b9ddaf6d6904dbe
SHA512

7246f7f8ce8f3e1414a8797a1a060362e0ff96b368235bae109800d49a27ca1447ea57b5a34f510262c69a10b85c8e5bb40e60e534c8691ade7d53bc608dd8ae
SSDEEP

12288:/3Xzmw3ZhYi8RMlACgdgzeYrda8saTcowCuB/Q:Sw3ZT4ueYrtTpwCm/

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1620 wrote to memory of 2908	1620	regsvr32.exe	28
PID 1620 wrote to memory of 2908	1620	regsvr32.exe	28
PID 1620 wrote to memory of 2908	1620	regsvr32.exe	28
PID 1620 wrote to memory of 2908	1620	regsvr32.exe	28
PID 1620 wrote to memory of 2908	1620	regsvr32.exe	28
PID 1620 wrote to memory of 2908	1620	regsvr32.exe	28
PID 1620 wrote to memory of 2908	1620	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\2a27e5b1c1369790cba00c00447bfc2b_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1620
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\2a27e5b1c1369790cba00c00447bfc2b_JaffaCakes118.dll
  2⤵
  PID:2908