2772f2b951415f873a389921d9f29ae414e1cc4a8b32328cfc52f9418ca0e0f8

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
11-07-2024 08:54

Target

3877a18c5de07dde0b3421f795a92b08_JaffaCakes118.dll
Size

86KB
MD5

3877a18c5de07dde0b3421f795a92b08
SHA1

69892774d56a39276036e7abb263ab09a02d9787
SHA256

2772f2b951415f873a389921d9f29ae414e1cc4a8b32328cfc52f9418ca0e0f8
SHA512

6ec8c8c92dafac6bf6f1efc4f4fc753a75dc5c321898b4e8ce532369ab506f308d72d01f594e65b24eeaa6168634f7561936871d82b10654bd0dbc0f291d10b1
SSDEEP

1536:blSmFExomr6dZaGzA3Asz4rbaZo5lXoUn/Bn8xg5iWqU+yQimTQGI:h1+xodHaGM3AszUbt//B8xd9w+TQGI

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2444 wrote to memory of 1792	2444	regsvr32.exe	30
PID 2444 wrote to memory of 1792	2444	regsvr32.exe	30
PID 2444 wrote to memory of 1792	2444	regsvr32.exe	30
PID 2444 wrote to memory of 1792	2444	regsvr32.exe	30
PID 2444 wrote to memory of 1792	2444	regsvr32.exe	30
PID 2444 wrote to memory of 1792	2444	regsvr32.exe	30
PID 2444 wrote to memory of 1792	2444	regsvr32.exe	30

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\3877a18c5de07dde0b3421f795a92b08_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2444
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\3877a18c5de07dde0b3421f795a92b08_JaffaCakes118.dll
  2⤵
  PID:1792

memory/1792-0-0x0000000001D80000-0x0000000001DC3000-memory.dmp

Filesize
268KB

Download