f3ff77367ce2b47d3ec6108430a7be47f0b4a47c728fffc47f2eff9053e3e518

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
10-07-2024 21:31

Target

3677fa8eb76677290bfe0588931fdfbe_JaffaCakes118.dll
Size

364KB
MD5

3677fa8eb76677290bfe0588931fdfbe
SHA1

cb2937ed35c75e74b342a53d92460115239a95a5
SHA256

f3ff77367ce2b47d3ec6108430a7be47f0b4a47c728fffc47f2eff9053e3e518
SHA512

29f28bb88e2b37b96001d5f6d911b6bf60d44af6a1647c0c84cb79bc5ec23638f597d5f285e6060e837ad1481908e0ccbe0a722cd13ad8b7030a8956041b9b21
SSDEEP

6144:40HMfWvptE9w3uXhg1ylVOnhKP3ESrtMkECguee1Qj/43wYKP:LGWvpu9Wq4y8AVdgux1c43wf

Score

1^/10

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{039EA4C0-E696-11d0-878A-00A0C91EC756}\ProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{039EA4C0-E696-11d0-878A-00A0C91EC756}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{039EA4C0-E696-11d0-878A-00A0C91EC756}\VersionIndependentProgID	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1736 wrote to memory of 1888	1736	regsvr32.exe	31
PID 1736 wrote to memory of 1888	1736	regsvr32.exe	31
PID 1736 wrote to memory of 1888	1736	regsvr32.exe	31
PID 1736 wrote to memory of 1888	1736	regsvr32.exe	31
PID 1736 wrote to memory of 1888	1736	regsvr32.exe	31
PID 1736 wrote to memory of 1888	1736	regsvr32.exe	31
PID 1736 wrote to memory of 1888	1736	regsvr32.exe	31

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\3677fa8eb76677290bfe0588931fdfbe_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1736
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\3677fa8eb76677290bfe0588931fdfbe_JaffaCakes118.dll
  2⤵
  - Modifies registry class
  PID:1888

memory/1888-0-0x0000000004720000-0x000000000477B000-memory.dmp

Filesize
364KB

Download
memory/1888-1-0x000000000474A000-0x0000000004773000-memory.dmp

Filesize
164KB

Download
memory/1888-2-0x0000000004720000-0x000000000477B000-memory.dmp

Filesize
364KB

Download
memory/1888-4-0x00000000001B0000-0x00000000001D5000-memory.dmp

Filesize
148KB

Download
memory/1888-3-0x0000000000160000-0x0000000000162000-memory.dmp

Filesize
8KB

Download