f189f86cbbc5b7d9da26b870e2dd45ea8afcdc7ba1b8e31d17dfb0adf0ae7288

Analysis

max time kernel
16s
max time network
17s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
09-07-2024 08:14

Target

2f9a47ec33c7c11fcfb2ee18ab8a28d5_JaffaCakes118.dll
Size

30KB
MD5

2f9a47ec33c7c11fcfb2ee18ab8a28d5
SHA1

4eec605f0de4b616c4677ad430cff5e7f3ebef72
SHA256

f189f86cbbc5b7d9da26b870e2dd45ea8afcdc7ba1b8e31d17dfb0adf0ae7288
SHA512

aed25785e233ccb653368259a64f1ed710d5ac1481cc990a04e3c8b7a3c27ad35cd73ac732b4d3f80f2a2dd6fb29930f622aeee0c2dcdc661606c815ef2913a6
SSDEEP

768:dKSyqusQX0GQhvgJSzUdattnAON2dCDrCk8:HyqusQX0GQhIYUdfON2d88

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1768 wrote to memory of 1332	1768	regsvr32.exe	30
PID 1768 wrote to memory of 1332	1768	regsvr32.exe	30
PID 1768 wrote to memory of 1332	1768	regsvr32.exe	30
PID 1768 wrote to memory of 1332	1768	regsvr32.exe	30
PID 1768 wrote to memory of 1332	1768	regsvr32.exe	30
PID 1768 wrote to memory of 1332	1768	regsvr32.exe	30
PID 1768 wrote to memory of 1332	1768	regsvr32.exe	30

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\2f9a47ec33c7c11fcfb2ee18ab8a28d5_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1768
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\2f9a47ec33c7c11fcfb2ee18ab8a28d5_JaffaCakes118.dll
  2⤵
  PID:1332

memory/1332-0-0x00000000000D0000-0x00000000000DD000-memory.dmp

Filesize
52KB

Download