f85fe52e68484b9be82c03ea001bc564f09e1cde07d4f3b70bcc80bc1c884f42

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
11/07/2024, 18:46

Target

3a53373e20d6457f73e977482eabf160_JaffaCakes118.dll
Size

172KB
MD5

3a53373e20d6457f73e977482eabf160
SHA1

07f49e5c6eaa6fbac1038172ca4a6e6776639fd1
SHA256

f85fe52e68484b9be82c03ea001bc564f09e1cde07d4f3b70bcc80bc1c884f42
SHA512

4c1a18b110df3eb99be628c4711d10c48dfa321ccc472a3ce2eaae3dcb99d2921057aab0a460532df8558f07ccd8cf9a3151b4ee19349ea261239a54bc660663
SSDEEP

3072:8BLlL1Yhd1PnhD69vSsQn9jSfzRL2QPIp1VX8jVHg9u6+R+Him57:8LlLEd1V65w2NPIM6+8

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3044 wrote to memory of 2240	3044	regsvr32.exe	30
PID 3044 wrote to memory of 2240	3044	regsvr32.exe	30
PID 3044 wrote to memory of 2240	3044	regsvr32.exe	30
PID 3044 wrote to memory of 2240	3044	regsvr32.exe	30
PID 3044 wrote to memory of 2240	3044	regsvr32.exe	30
PID 3044 wrote to memory of 2240	3044	regsvr32.exe	30
PID 3044 wrote to memory of 2240	3044	regsvr32.exe	30

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\3a53373e20d6457f73e977482eabf160_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3044
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\3a53373e20d6457f73e977482eabf160_JaffaCakes118.dll
  2⤵
  PID:2240