1302536eb9fe7f63e7c886c2a041cfec7c09fcf594ec62c088a638e6d2b15aeb

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
09/07/2024, 17:34

Target

315206828237fd2bcc5ea26ea1ea9443_JaffaCakes118.dll
Size

541KB
MD5

315206828237fd2bcc5ea26ea1ea9443
SHA1

6501cacca59c43d5f242b753c99af464f5431b62
SHA256

1302536eb9fe7f63e7c886c2a041cfec7c09fcf594ec62c088a638e6d2b15aeb
SHA512

357a0746ea6be5ad04211840190d32c73f0382d474bb37298c2b5d23f994247da4947f7d9a468bcfa5c48a30bea798092380dbf2a0ced3bdb19fe9e11c0be8e7
SSDEEP

12288:LAQGHPdVlOPjtK6QUwvF3Z4mxxQfFpCDRGNyH7:LAQEOLyQmX8pCDckb

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2376	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2632 wrote to memory of 2376	2632	regsvr32.exe	31
PID 2632 wrote to memory of 2376	2632	regsvr32.exe	31
PID 2632 wrote to memory of 2376	2632	regsvr32.exe	31
PID 2632 wrote to memory of 2376	2632	regsvr32.exe	31
PID 2632 wrote to memory of 2376	2632	regsvr32.exe	31
PID 2632 wrote to memory of 2376	2632	regsvr32.exe	31
PID 2632 wrote to memory of 2376	2632	regsvr32.exe	31

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\315206828237fd2bcc5ea26ea1ea9443_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2632
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\315206828237fd2bcc5ea26ea1ea9443_JaffaCakes118.dll
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2376

memory/2376-0-0x00000000008C0000-0x00000000009E7000-memory.dmp

Filesize
1.2MB

Download
memory/2376-1-0x00000000022D0000-0x0000000002324000-memory.dmp

Filesize
336KB

Download
memory/2376-2-0x00000000008C0000-0x00000000009E7000-memory.dmp

Filesize
1.2MB

Download
memory/2376-3-0x00000000008C0000-0x00000000009E7000-memory.dmp

Filesize
1.2MB

Download
memory/2376-4-0x00000000022D0000-0x0000000002324000-memory.dmp

Filesize
336KB

Download