a23af2cd0f9c67e1543251b509ffa3618321f3c524c57eb2f0ea971ec6565989

Analysis

max time kernel
11s
max time network
16s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
10/07/2024, 03:52

Target

3333a57b12adb60a03b706d34beb8f7b_JaffaCakes118.dll
Size

33KB
MD5

3333a57b12adb60a03b706d34beb8f7b
SHA1

9b1eac9935997dcc89e0bb5658847bc2171bfb58
SHA256

a23af2cd0f9c67e1543251b509ffa3618321f3c524c57eb2f0ea971ec6565989
SHA512

66c6c1a63689e01f0007f89ecf3914c54f1b04b51e595105f25d1345b414ccd303ba4ba0867356e00a0246cfc3e2bb9414cd0e16c6213b985515a466f7ba728e
SSDEEP

768:T+v9hxFUPcYmFXwuELKFZMj2DbVWk4pfwiOMkS:TE/xePcYeXw0MKVh6NkS

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2344 wrote to memory of 2540	2344	regsvr32.exe	30
PID 2344 wrote to memory of 2540	2344	regsvr32.exe	30
PID 2344 wrote to memory of 2540	2344	regsvr32.exe	30
PID 2344 wrote to memory of 2540	2344	regsvr32.exe	30
PID 2344 wrote to memory of 2540	2344	regsvr32.exe	30
PID 2344 wrote to memory of 2540	2344	regsvr32.exe	30
PID 2344 wrote to memory of 2540	2344	regsvr32.exe	30

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\3333a57b12adb60a03b706d34beb8f7b_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2344
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\3333a57b12adb60a03b706d34beb8f7b_JaffaCakes118.dll
  2⤵
  PID:2540

memory/2540-0-0x0000000000170000-0x000000000017E000-memory.dmp

Filesize
56KB

Download