16ef1af47ee665aa11fcd5346bd194aa321302c4e9677c9e2231a5aadec1b7b5

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
08-07-2024 08:32

Target

2baa31641b1a6494c4b71358c2eb89e6_JaffaCakes118.dll
Size

156KB
MD5

2baa31641b1a6494c4b71358c2eb89e6
SHA1

8d63d115695fec95d8d56794d9aef134937abf75
SHA256

16ef1af47ee665aa11fcd5346bd194aa321302c4e9677c9e2231a5aadec1b7b5
SHA512

85c1906d5216d0c061d2a78a2855f82dca90176763d059fc157b40f6be1a1b2ef171d52cce354d3e13776f31bdcbd8040f7dded8a08fcf940ed6a0607fc13c2e
SSDEEP

3072:w714bkuu9fuB6puxb/l0dZ8/LG42X8ZxrmkM3QilDWgLycrXDQrE3nn:wR4vmeMu/0zcWX8ZxKdQM7X

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2416 wrote to memory of 3068	2416	regsvr32.exe	30
PID 2416 wrote to memory of 3068	2416	regsvr32.exe	30
PID 2416 wrote to memory of 3068	2416	regsvr32.exe	30
PID 2416 wrote to memory of 3068	2416	regsvr32.exe	30
PID 2416 wrote to memory of 3068	2416	regsvr32.exe	30
PID 2416 wrote to memory of 3068	2416	regsvr32.exe	30
PID 2416 wrote to memory of 3068	2416	regsvr32.exe	30

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\2baa31641b1a6494c4b71358c2eb89e6_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2416
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\2baa31641b1a6494c4b71358c2eb89e6_JaffaCakes118.dll
  2⤵
  PID:3068