f298f306cd5d4156a5654ebf76c26181689241992d1c1de0b027a59258afd27e

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
10/07/2024, 02:06

Target

32e83249347156c55d28ff0051814db2_JaffaCakes118.dll
Size

82KB
MD5

32e83249347156c55d28ff0051814db2
SHA1

bb8e1e0132c5460efe6c3c4634edda56684286e9
SHA256

f298f306cd5d4156a5654ebf76c26181689241992d1c1de0b027a59258afd27e
SHA512

7f8324b01d8849f0cc7412d7ff92e203a4e70ad316dbd7da92444cecb6753e0e79efa628092018b5b6e2336a57277a6bf38539dc14c882c9318b3883fec97f2f
SSDEEP

1536:QQ+2Ful5zRJvE9hPqGPb2j2H3Qx4UDytx1Dnge929ICplmt6XSlZbY:QQ+xXrvIUGPr43DyVX92Pp4t6CZU

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1516 wrote to memory of 2516	1516	regsvr32.exe	30
PID 1516 wrote to memory of 2516	1516	regsvr32.exe	30
PID 1516 wrote to memory of 2516	1516	regsvr32.exe	30
PID 1516 wrote to memory of 2516	1516	regsvr32.exe	30
PID 1516 wrote to memory of 2516	1516	regsvr32.exe	30
PID 1516 wrote to memory of 2516	1516	regsvr32.exe	30
PID 1516 wrote to memory of 2516	1516	regsvr32.exe	30

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\32e83249347156c55d28ff0051814db2_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1516
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\32e83249347156c55d28ff0051814db2_JaffaCakes118.dll
  2⤵
  PID:2516

memory/2516-0-0x00000000001F0000-0x000000000022F000-memory.dmp

Filesize
252KB

Download