399d01e43204c92568b93b93b0ac8c427f722d4773ab43b2a758ce7e45ff16fd

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
10-07-2024 19:33

Target

3616ed14bf7c87b0903066041bb3fc5d_JaffaCakes118.dll
Size

137KB
MD5

3616ed14bf7c87b0903066041bb3fc5d
SHA1

d57390153670191c22cd7f0fcf1acb697fc34cf7
SHA256

399d01e43204c92568b93b93b0ac8c427f722d4773ab43b2a758ce7e45ff16fd
SHA512

6833a61f4134038f59fb7f7829ee7cd3c62de3e7b8805c29b9edfc7e785ce49eb2448e89d211c88fa9c4c5edbdffdac38def833eed5562f1ce7eb69ab8aeb208
SSDEEP

3072:2va6tOSk4eJw6BBO/ku0pBTNBoJ5Pn2+mfyGlgH:QPAd4uJTuOPae+nH

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2484 wrote to memory of 2504	2484	regsvr32.exe	30
PID 2484 wrote to memory of 2504	2484	regsvr32.exe	30
PID 2484 wrote to memory of 2504	2484	regsvr32.exe	30
PID 2484 wrote to memory of 2504	2484	regsvr32.exe	30
PID 2484 wrote to memory of 2504	2484	regsvr32.exe	30
PID 2484 wrote to memory of 2504	2484	regsvr32.exe	30
PID 2484 wrote to memory of 2504	2484	regsvr32.exe	30

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\3616ed14bf7c87b0903066041bb3fc5d_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2484
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\3616ed14bf7c87b0903066041bb3fc5d_JaffaCakes118.dll
  2⤵
  PID:2504