c5589bb282f14c6d5a443ddb50f8931a7cec9b4eab0c4efbc636984c39a8b81c

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
09/07/2024, 01:23

Target

2e84c56cd9fb4f96264e4eb63cbe445a_JaffaCakes118.dll
Size

80KB
MD5

2e84c56cd9fb4f96264e4eb63cbe445a
SHA1

3d8efda0825de5486835a97b0aede973c6296930
SHA256

c5589bb282f14c6d5a443ddb50f8931a7cec9b4eab0c4efbc636984c39a8b81c
SHA512

5d090c66586801c6d37613400a87368edbb00f3307725b54ad98fd098be3aabb8fd393009894f5f21683c836d6450eff109cb7d4c8444e456813bbfd2b7882de
SSDEEP

1536:bNqDQpy4BtEznCTS0/sti0onyZGOxI2s0ciXjK3mgfEzYTmeB8cW+tbueorU4Kj4:mCy47EIScKSy/xvs0cizK3mgfXzB8cT8

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2688 wrote to memory of 2736	2688	regsvr32.exe	30
PID 2688 wrote to memory of 2736	2688	regsvr32.exe	30
PID 2688 wrote to memory of 2736	2688	regsvr32.exe	30
PID 2688 wrote to memory of 2736	2688	regsvr32.exe	30
PID 2688 wrote to memory of 2736	2688	regsvr32.exe	30
PID 2688 wrote to memory of 2736	2688	regsvr32.exe	30
PID 2688 wrote to memory of 2736	2688	regsvr32.exe	30

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\2e84c56cd9fb4f96264e4eb63cbe445a_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2688
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\2e84c56cd9fb4f96264e4eb63cbe445a_JaffaCakes118.dll
  2⤵
  PID:2736

memory/2736-0-0x0000000000190000-0x00000000001A9000-memory.dmp

Filesize
100KB

Download