77c9e885669549efdcd0eff767b430879a08df9592b45f06116b8e0624c2de39

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
09-07-2024 10:47

Target

3010a1a045d8cb9430be7e304052687c_JaffaCakes118.dll
Size

163KB
MD5

3010a1a045d8cb9430be7e304052687c
SHA1

e5216fab9aeea891e5784e41d8a83f2eabfd8a4b
SHA256

77c9e885669549efdcd0eff767b430879a08df9592b45f06116b8e0624c2de39
SHA512

7a44ad442c05053028f3c2eb9644f13ab5fbd4e38dd35ea0169c8f2da686c285b7d32707fe828d208a52379fe796c6013e1259e7dfac4f1ade4e9648e6978edc
SSDEEP

3072:eY5XNY5XNY5XNY5XNY5XNY5XNY5XNY5XNY5XNY5XR:pXQXQXQXQXQXQXQXQXQXR

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2368 wrote to memory of 2228	2368	regsvr32.exe	30
PID 2368 wrote to memory of 2228	2368	regsvr32.exe	30
PID 2368 wrote to memory of 2228	2368	regsvr32.exe	30
PID 2368 wrote to memory of 2228	2368	regsvr32.exe	30
PID 2368 wrote to memory of 2228	2368	regsvr32.exe	30
PID 2368 wrote to memory of 2228	2368	regsvr32.exe	30
PID 2368 wrote to memory of 2228	2368	regsvr32.exe	30

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\3010a1a045d8cb9430be7e304052687c_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2368
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\3010a1a045d8cb9430be7e304052687c_JaffaCakes118.dll
  2⤵
  PID:2228