988bc6a1cf16cb0efb65036c8aaeae4a853a55c43109cf7365d9befe4b2e1bc7

Analysis

max time kernel
119s
max time network
129s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
10/07/2024, 03:47

Target

332f95eb0623c238f9776d0b2f4c9be2_JaffaCakes118.dll
Size

82KB
MD5

332f95eb0623c238f9776d0b2f4c9be2
SHA1

d7717b829e1615f7afc28808236b707fe8035ba2
SHA256

988bc6a1cf16cb0efb65036c8aaeae4a853a55c43109cf7365d9befe4b2e1bc7
SHA512

2a09e4d02e530a223fe957419b5fed6bbcb7b8f880111149c6eb4d4e97b770597ab7ec7c9e9d6968e224ddbe9d5c04e45505bd4a0b77b54c6ecd4009f0492023
SSDEEP

1536:tkFV+UjRbwz0pi4/C0J6WYDiVHbFCDXcb0tWcGhJW9rX:tkDBjmz0p9C0aGxeXA0bGhJW1X

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3032 wrote to memory of 2772	3032	regsvr32.exe	30
PID 3032 wrote to memory of 2772	3032	regsvr32.exe	30
PID 3032 wrote to memory of 2772	3032	regsvr32.exe	30
PID 3032 wrote to memory of 2772	3032	regsvr32.exe	30
PID 3032 wrote to memory of 2772	3032	regsvr32.exe	30
PID 3032 wrote to memory of 2772	3032	regsvr32.exe	30
PID 3032 wrote to memory of 2772	3032	regsvr32.exe	30

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\332f95eb0623c238f9776d0b2f4c9be2_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3032
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\332f95eb0623c238f9776d0b2f4c9be2_JaffaCakes118.dll
  2⤵
  PID:2772

memory/2772-0-0x0000000000230000-0x000000000026E000-memory.dmp

Filesize
248KB

Download