7eacd8f22115ea2e41cc4a86ca163ed319639119f4c58fe913a64663bb2609f7

Analysis

max time kernel
12s
max time network
19s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
09-07-2024 05:05

Target

2f133256c1466c32b11ba021fe67cbf1_JaffaCakes118.exe
Size

4KB
MD5

2f133256c1466c32b11ba021fe67cbf1
SHA1

6eab158e913af0ba3400c581a06043ae483fccd6
SHA256

7eacd8f22115ea2e41cc4a86ca163ed319639119f4c58fe913a64663bb2609f7
SHA512

4bc205bb340dcb323e85e1912587a58de978df54c04d25217ebc8cc4dd8b821e3c32e99be81973ddca8f9e57985461b2cadce47203c111b6b0fa0624a8c4655f
SSDEEP

48:6+iuLxvt+Pqzry5PnUpB/S1cYzr66NaYJiSolIKEVB1BtsehEW2QGI6ctbcSen/S:/iuLxl+PqzO/9W6R3LT2ojSUOogOpB/

Score

1^/10

Runs .reg file with regedit 1 IoCs

pid	Process
896	regedit.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2432 wrote to memory of 896	2432	2f133256c1466c32b11ba021fe67cbf1_JaffaCakes118.exe	29
PID 2432 wrote to memory of 896	2432	2f133256c1466c32b11ba021fe67cbf1_JaffaCakes118.exe	29
PID 2432 wrote to memory of 896	2432	2f133256c1466c32b11ba021fe67cbf1_JaffaCakes118.exe	29
PID 2432 wrote to memory of 896	2432	2f133256c1466c32b11ba021fe67cbf1_JaffaCakes118.exe	29

C:\Users\Admin\AppData\Local\Temp\2f133256c1466c32b11ba021fe67cbf1_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2f133256c1466c32b11ba021fe67cbf1_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2432
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe -s C:\ParaTemp.reg
  2⤵
  - Runs .reg file with regedit
  PID:896

C:\ParaTemp.reg

Filesize
138B

MD5
58626826af92f3c9653c01402120fead

SHA1
0baa2b41b722c844e963ac4eff8e526f940b65c7

SHA256
0cf855ecce0e969311055c1129fd1424932bd166b6921dbe84ead43a9fc4b040

SHA512
ea863dff98d86376ca06798390ebc454bc5334b6054421953f86775a704115c7b4f277d5ee33c87d6db651e62a4964d0ae9d48ad173011722ea25901f0cf5a91

Download Submit
memory/2432-1-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download