c59e7f0425f3160307d3fc71315a78d7143e16c6e7b93cee1ccf91f00e16bb7b

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
11/07/2024, 00:40

Target

370d8991d00b742aa7ab55108fd13ca6_JaffaCakes118.dll
Size

234KB
MD5

370d8991d00b742aa7ab55108fd13ca6
SHA1

6f5f6f18a6c0096f95af9d2ff5084e0aaec18609
SHA256

c59e7f0425f3160307d3fc71315a78d7143e16c6e7b93cee1ccf91f00e16bb7b
SHA512

e2709d7c3112d8622a0324b36e8d47fb4c1001d19aeb925c8f6f2367006b17a55fc9d93fd1f7c4fc856e9c81aefcaadaf167bdc5659e221da0b1f79e1ef5c745
SSDEEP

6144:NWa74XgWa74XgWa74XgWa74XgWa74XgWa74XgWa74X:NWaEgWaEgWaEgWaEgWaEgWaEgWaE

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2988 wrote to memory of 2472	2988	regsvr32.exe	31
PID 2988 wrote to memory of 2472	2988	regsvr32.exe	31
PID 2988 wrote to memory of 2472	2988	regsvr32.exe	31
PID 2988 wrote to memory of 2472	2988	regsvr32.exe	31
PID 2988 wrote to memory of 2472	2988	regsvr32.exe	31
PID 2988 wrote to memory of 2472	2988	regsvr32.exe	31
PID 2988 wrote to memory of 2472	2988	regsvr32.exe	31

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\370d8991d00b742aa7ab55108fd13ca6_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2988
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\370d8991d00b742aa7ab55108fd13ca6_JaffaCakes118.dll
  2⤵
  PID:2472

memory/2472-0-0x0000000000150000-0x000000000015E000-memory.dmp

Filesize
56KB

Download