e66c697357cff3242f50f5a7efb81ce801a2552bed0bbce8c5b2a15a34a555ee

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
12/07/2024, 00:44

Target

3b5e5837153d3514cdba8200036c5ced_JaffaCakes118.dll
Size

122KB
MD5

3b5e5837153d3514cdba8200036c5ced
SHA1

8bd02d9ccd8720686950aac4052d567611e2660c
SHA256

e66c697357cff3242f50f5a7efb81ce801a2552bed0bbce8c5b2a15a34a555ee
SHA512

6e637378e2d3086ef713aad58b403e332851d9a5a0c4df380abec986d044a3d4fcf294cd26424386fe1448d22ecc534328d3ce053185b9806c818558cfbff851
SSDEEP

3072:+ByVkyjgoSGDxrc+MXVn1YKU7tBvYSL/u9zdK+44Ldh:+BiBjgE6+MXV1YFBvYC/MK+44x

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2644 wrote to memory of 2736	2644	regsvr32.exe	30
PID 2644 wrote to memory of 2736	2644	regsvr32.exe	30
PID 2644 wrote to memory of 2736	2644	regsvr32.exe	30
PID 2644 wrote to memory of 2736	2644	regsvr32.exe	30
PID 2644 wrote to memory of 2736	2644	regsvr32.exe	30
PID 2644 wrote to memory of 2736	2644	regsvr32.exe	30
PID 2644 wrote to memory of 2736	2644	regsvr32.exe	30

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\3b5e5837153d3514cdba8200036c5ced_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2644
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\3b5e5837153d3514cdba8200036c5ced_JaffaCakes118.dll
  2⤵
  PID:2736

memory/2736-0-0x0000000000210000-0x0000000000264000-memory.dmp

Filesize
336KB

Download