19dba1542821dfff01227e065e0b6a5ebf9384cca5640831bdda10d4a14b05fe

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
08/07/2024, 03:40

Target

2adb7bc2548d0800176c5d2c7875e776_JaffaCakes118.dll
Size

44KB
MD5

2adb7bc2548d0800176c5d2c7875e776
SHA1

0be75def6c09a9eff519837f528b579d48271158
SHA256

19dba1542821dfff01227e065e0b6a5ebf9384cca5640831bdda10d4a14b05fe
SHA512

c29b4482c93678d580ff87f09966a900b1fe7aced1c57e27cfd42b68266fa4ae1d35414a7b6b7f2fbb8988d82d967cf495a7b0d6bebff6b9ff4110ec02a65478
SSDEEP

384:Y8vDtkav5wRkVoq3byOao1vxRpmU51g3nbcwEya9Vp/d1kkF3xMx8zSJpJgLa0MO:Tpkav+RL+q3haHpV1n5xMxdgLa1

Score

1^/10

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2408	Rundll32.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2408	Rundll32.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1916 wrote to memory of 2224	1916	regsvr32.exe	28
PID 1916 wrote to memory of 2224	1916	regsvr32.exe	28
PID 1916 wrote to memory of 2224	1916	regsvr32.exe	28
PID 1916 wrote to memory of 2224	1916	regsvr32.exe	28
PID 1916 wrote to memory of 2224	1916	regsvr32.exe	28
PID 1916 wrote to memory of 2224	1916	regsvr32.exe	28
PID 1916 wrote to memory of 2224	1916	regsvr32.exe	28
PID 2224 wrote to memory of 2408	2224	regsvr32.exe	29
PID 2224 wrote to memory of 2408	2224	regsvr32.exe	29
PID 2224 wrote to memory of 2408	2224	regsvr32.exe	29
PID 2224 wrote to memory of 2408	2224	regsvr32.exe	29
PID 2224 wrote to memory of 2408	2224	regsvr32.exe	29
PID 2224 wrote to memory of 2408	2224	regsvr32.exe	29
PID 2224 wrote to memory of 2408	2224	regsvr32.exe	29

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\2adb7bc2548d0800176c5d2c7875e776_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1916
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\2adb7bc2548d0800176c5d2c7875e776_JaffaCakes118.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2224
- - C:\Windows\SysWOW64\Rundll32.exe
    C:\Windows\system32\Rundll32.exe C:\Users\Admin\AppData\Local\Temp\2adb7bc2548d0800176c5d2c7875e776_JaffaCakes118.dll,DllUnregisterServer
    3⤵
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    PID:2408