447a8d6980cf3d934703cc82da5cecd4d547358a562275164a6b229db8fa01ae

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
10-07-2024 17:35

Target

35b730b8458fe3e1b63aa552e04b576f_JaffaCakes118.dll
Size

305KB
MD5

35b730b8458fe3e1b63aa552e04b576f
SHA1

9cb717bc13658edc28610e268275c5a239b22f9e
SHA256

447a8d6980cf3d934703cc82da5cecd4d547358a562275164a6b229db8fa01ae
SHA512

34f3af381dad4276cf87159dd57cf77b6a41a8e3f5d53790332b3c8459bab93b6c1b77f253c937b1b59eaa907c1ff84e557006e653857c71bc1dd3865cf1916d
SSDEEP

6144:26hE5OTeMH3YBfrrTMF74mmhboq90EDfXFwtooLSB+y:26hE5OSMHoRfu78ZoXEDfXKtooLQN

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1840 wrote to memory of 2032	1840	regsvr32.exe	31
PID 1840 wrote to memory of 2032	1840	regsvr32.exe	31
PID 1840 wrote to memory of 2032	1840	regsvr32.exe	31
PID 1840 wrote to memory of 2032	1840	regsvr32.exe	31
PID 1840 wrote to memory of 2032	1840	regsvr32.exe	31
PID 1840 wrote to memory of 2032	1840	regsvr32.exe	31
PID 1840 wrote to memory of 2032	1840	regsvr32.exe	31

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\35b730b8458fe3e1b63aa552e04b576f_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1840
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\35b730b8458fe3e1b63aa552e04b576f_JaffaCakes118.dll
  2⤵
  PID:2032