d26015f82c4ef358aecddd4eb79f962244b1088b7007dc3b056c6f229a375351

Analysis

max time kernel
13s
max time network
19s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
08-07-2024 01:01

Target

2a6e1022aa999f1216716ee2e2441692_JaffaCakes118.dll
Size

47KB
MD5

2a6e1022aa999f1216716ee2e2441692
SHA1

8856278865e9b7d49bb66f871aebe18efd1a48f0
SHA256

d26015f82c4ef358aecddd4eb79f962244b1088b7007dc3b056c6f229a375351
SHA512

cca8bdd49d166bebfd0c97a995194178deb36745dd5f9ed7ffcd9df7e53d6db2ceab6e24b41e2c545b7d61839901df2203192a5f2b36f17b9f6d13c0abec79ed
SSDEEP

768:3BiCCKqhQIoCiEFLyBxRNAgOpiO5OpBl5YTL4NY0sKnaizbPMe44PibXChqpLXu:RGKqhQKNFLyBxRN3QiGOpBl2fahn1r7p

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1848 wrote to memory of 2296	1848	regsvr32.exe	30
PID 1848 wrote to memory of 2296	1848	regsvr32.exe	30
PID 1848 wrote to memory of 2296	1848	regsvr32.exe	30
PID 1848 wrote to memory of 2296	1848	regsvr32.exe	30
PID 1848 wrote to memory of 2296	1848	regsvr32.exe	30
PID 1848 wrote to memory of 2296	1848	regsvr32.exe	30
PID 1848 wrote to memory of 2296	1848	regsvr32.exe	30

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\2a6e1022aa999f1216716ee2e2441692_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1848
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\2a6e1022aa999f1216716ee2e2441692_JaffaCakes118.dll
  2⤵
  PID:2296

memory/2296-0-0x0000000000330000-0x0000000000341000-memory.dmp

Filesize
68KB

Download