6cfe6ff4d8d31a0a6dd80b6dbab2665c6048ea5a6632caf241f4e86667ffa173

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
08/07/2024, 17:18

Target

2d2cae6d76b727d98e12c9c2d0676f17_JaffaCakes118.dll
Size

158KB
MD5

2d2cae6d76b727d98e12c9c2d0676f17
SHA1

7d832ad79e1ba823365fe16324d8b8a46961ea6f
SHA256

6cfe6ff4d8d31a0a6dd80b6dbab2665c6048ea5a6632caf241f4e86667ffa173
SHA512

a6cc622c24d86dcd77c8b1cdc8fe0ec8b68a043736ae6dc8ff4a37e6e6f8a3e1ee59e02454d4cb2aaea81f3fa6adc10b21328c589224d74dfb295bd621c33a54
SSDEEP

3072:1//VMwqBkfIs6rzszUbt//B8xd9279Zjf5W6r:l/VbqBKIs68a//B6AA6

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1512 wrote to memory of 2460	1512	regsvr32.exe	30
PID 1512 wrote to memory of 2460	1512	regsvr32.exe	30
PID 1512 wrote to memory of 2460	1512	regsvr32.exe	30
PID 1512 wrote to memory of 2460	1512	regsvr32.exe	30
PID 1512 wrote to memory of 2460	1512	regsvr32.exe	30
PID 1512 wrote to memory of 2460	1512	regsvr32.exe	30
PID 1512 wrote to memory of 2460	1512	regsvr32.exe	30

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\2d2cae6d76b727d98e12c9c2d0676f17_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1512
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\2d2cae6d76b727d98e12c9c2d0676f17_JaffaCakes118.dll
  2⤵
  PID:2460

memory/2460-0-0x0000000000390000-0x00000000003D3000-memory.dmp

Filesize
268KB

Download