450aa9da5d6d05c7d5f8a15beb3b9605ef0a35415c164c1a52304d0d133ca936

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
08/07/2024, 15:17

Target

2cd1785f39e295a02ff289912ba5b5da_JaffaCakes118.dll
Size

124KB
MD5

2cd1785f39e295a02ff289912ba5b5da
SHA1

0a573a96e1b86c334c2bdfbf30ed6d0656e79c32
SHA256

450aa9da5d6d05c7d5f8a15beb3b9605ef0a35415c164c1a52304d0d133ca936
SHA512

cb4c1d4d52dd9075aaae5ad4775dc3969d0237f5ed110b17ad1702049b876cb4b2dead067e7e256b53c41d152b1ac8c6584046d1c366c9a56e0cc28342a0f07d
SSDEEP

3072:v/52cSj1+PQahVfec0Ts/5Fa/rpGOvzNUko7:xs+XT/0Ts/5FFOzS

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1412 wrote to memory of 2108	1412	regsvr32.exe	30
PID 1412 wrote to memory of 2108	1412	regsvr32.exe	30
PID 1412 wrote to memory of 2108	1412	regsvr32.exe	30
PID 1412 wrote to memory of 2108	1412	regsvr32.exe	30
PID 1412 wrote to memory of 2108	1412	regsvr32.exe	30
PID 1412 wrote to memory of 2108	1412	regsvr32.exe	30
PID 1412 wrote to memory of 2108	1412	regsvr32.exe	30

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\2cd1785f39e295a02ff289912ba5b5da_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1412
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\2cd1785f39e295a02ff289912ba5b5da_JaffaCakes118.dll
  2⤵
  PID:2108