855ca22320f1284d3de551466d7e31730b8d89eca79100e33681fd913670df10

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
08/07/2024, 12:36

Target

2c5ee5c6705e7d4cf8d62f5264c239db_JaffaCakes118.dll
Size

85KB
MD5

2c5ee5c6705e7d4cf8d62f5264c239db
SHA1

1a9289564fa9b1d044a36c9c40a45cbb3954464a
SHA256

855ca22320f1284d3de551466d7e31730b8d89eca79100e33681fd913670df10
SHA512

bbf660316a46af5d622fbd8fa016801509e64861e9cd9973d343d18e6f019f954513510077f9cf00c3c908812aeff845a5c7f6f5c69f52d83e96f94ab1af3be4
SSDEEP

1536:wTnDhFjclsWVM3p3VME/9wBL1Ze66jP5BHdSZBKglJFrVzdbDWKmYkE95r:wDDLcj2plMEOpjIkZBFlBdbDWKrkEX

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2876 wrote to memory of 2644	2876	regsvr32.exe	30
PID 2876 wrote to memory of 2644	2876	regsvr32.exe	30
PID 2876 wrote to memory of 2644	2876	regsvr32.exe	30
PID 2876 wrote to memory of 2644	2876	regsvr32.exe	30
PID 2876 wrote to memory of 2644	2876	regsvr32.exe	30
PID 2876 wrote to memory of 2644	2876	regsvr32.exe	30
PID 2876 wrote to memory of 2644	2876	regsvr32.exe	30

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\2c5ee5c6705e7d4cf8d62f5264c239db_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2876
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\2c5ee5c6705e7d4cf8d62f5264c239db_JaffaCakes118.dll
  2⤵
  PID:2644

memory/2644-0-0x00000000002A0000-0x00000000002E3000-memory.dmp

Filesize
268KB

Download