93e4fd0a1d8266103c2d40aa31775eaba0911a5ad2b71da0ca2a49af8223757f

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
10/07/2024, 04:39

Target

33536c5b199289ec8988d501fa9a1338_JaffaCakes118.dll
Size

83KB
MD5

33536c5b199289ec8988d501fa9a1338
SHA1

f748ab72ccbdeadde4dc1a0fcd9a11089e8f1021
SHA256

93e4fd0a1d8266103c2d40aa31775eaba0911a5ad2b71da0ca2a49af8223757f
SHA512

ee05de54b0fc6b8e3b6ff40b9efb274330ba6a5a5f6f2fae06bdeeceb416d72169da157e6c084a91580edf58145871693c255014644b17a8d29391955206b2a3
SSDEEP

1536:rSOMRJcRXodBhCA66v0gRPF0h8k79Pl5E0HW6rA8bnX+xiSfZnfAlLgDnhXMc:GVKRWhCt6vjRPFidkS/ShXyc

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2636 wrote to memory of 2672	2636	regsvr32.exe	30
PID 2636 wrote to memory of 2672	2636	regsvr32.exe	30
PID 2636 wrote to memory of 2672	2636	regsvr32.exe	30
PID 2636 wrote to memory of 2672	2636	regsvr32.exe	30
PID 2636 wrote to memory of 2672	2636	regsvr32.exe	30
PID 2636 wrote to memory of 2672	2636	regsvr32.exe	30
PID 2636 wrote to memory of 2672	2636	regsvr32.exe	30

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\33536c5b199289ec8988d501fa9a1338_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2636
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\33536c5b199289ec8988d501fa9a1338_JaffaCakes118.dll
  2⤵
  PID:2672

memory/2672-0-0x0000000000250000-0x000000000028E000-memory.dmp

Filesize
248KB

Download