d632b1b1f606a28018a7dc8215cfc470ef7c86666fdd7839b128a8ee200f31e9

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
11/07/2024, 10:59

Target

38d6edde9809cd2f95921b58ffe3f2d7_JaffaCakes118.dll
Size

90KB
MD5

38d6edde9809cd2f95921b58ffe3f2d7
SHA1

406f7463c1fef737c3cf6b1f065ac50deefa2525
SHA256

d632b1b1f606a28018a7dc8215cfc470ef7c86666fdd7839b128a8ee200f31e9
SHA512

82304a4ac393de5d44e68748920d1f1d40b79868c36f61d8c2ed54a051d11dda53637bd8acf3fae8f815bc256922b54310119de5f3ed5d7d0943031a98e6a55e
SSDEEP

1536:WY73mGEFz/8ERxHx9CTOUgbduXGwxv2CHxRc085SqnWBdAUHTOUu:WO2zPTHxsTOUgbAXGwxeefcsbVTOUu

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1984 wrote to memory of 2428	1984	regsvr32.exe	30
PID 1984 wrote to memory of 2428	1984	regsvr32.exe	30
PID 1984 wrote to memory of 2428	1984	regsvr32.exe	30
PID 1984 wrote to memory of 2428	1984	regsvr32.exe	30
PID 1984 wrote to memory of 2428	1984	regsvr32.exe	30
PID 1984 wrote to memory of 2428	1984	regsvr32.exe	30
PID 1984 wrote to memory of 2428	1984	regsvr32.exe	30

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\38d6edde9809cd2f95921b58ffe3f2d7_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1984
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\38d6edde9809cd2f95921b58ffe3f2d7_JaffaCakes118.dll
  2⤵
  PID:2428

memory/2428-0-0x0000000000140000-0x0000000000184000-memory.dmp

Filesize
272KB

Download