0f4f3217150d2272bb70919ea611193bddb7d27061d068c0f1a309e2c8cd728b

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
11/07/2024, 09:26

Target

388fa83010a65f83a7a86aa7aa390d89_JaffaCakes118.dll
Size

43KB
MD5

388fa83010a65f83a7a86aa7aa390d89
SHA1

26d8ecf5b6120d75493f483ced858d94d8c5e810
SHA256

0f4f3217150d2272bb70919ea611193bddb7d27061d068c0f1a309e2c8cd728b
SHA512

56f7c38f6f67d1d607d21d02b82030a570ec5a3f2bf8aec6e0e87b07463db414cd28c6911e6d394f4f59a691a3d53c7024d0f2120f75ab3f64a5a507a97c1cd6
SSDEEP

768:UyG4FRhxdtdDqSMD5GN1TucQn2SLcn116Av/8UcLq+35mTbJsE5C86QMMGopW:UyGwFdtdDqSM4NscO1Q1NvUUcLhubJsY

Score

1^/10

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B4A78D29-52B1-4A7B-BAC0-1471BEDF9836}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B4A78D29-52B1-4A7B-BAC0-1471BEDF9836}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B4A78D29-52B1-4A7B-BAC0-1471BEDF9836}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\388fa83010a65f83a7a86aa7aa390d89_JaffaCakes118.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B4A78D29-52B1-4A7B-BAC0-1471BEDF9836}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2324 wrote to memory of 2308	2324	regsvr32.exe	31
PID 2324 wrote to memory of 2308	2324	regsvr32.exe	31
PID 2324 wrote to memory of 2308	2324	regsvr32.exe	31
PID 2324 wrote to memory of 2308	2324	regsvr32.exe	31
PID 2324 wrote to memory of 2308	2324	regsvr32.exe	31
PID 2324 wrote to memory of 2308	2324	regsvr32.exe	31
PID 2324 wrote to memory of 2308	2324	regsvr32.exe	31

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\388fa83010a65f83a7a86aa7aa390d89_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2324
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\388fa83010a65f83a7a86aa7aa390d89_JaffaCakes118.dll
  2⤵
  - Modifies registry class
  PID:2308