06631345d0e8f5cd1dfeba4114b963782f7d39bea7335fae5de7e2e18360c436

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
13/07/2024, 16:45

Target

42849b0c3ee88ffe16233fdb1385da34_JaffaCakes118.dll
Size

44KB
MD5

42849b0c3ee88ffe16233fdb1385da34
SHA1

94611f9d9d5a315daf9ac8b020fdf9cd1aff0ec2
SHA256

06631345d0e8f5cd1dfeba4114b963782f7d39bea7335fae5de7e2e18360c436
SHA512

d97c774621a18dd1c8170ff9e83325bfe549cfa5f3f6159be4cdeec0d61306a17f65e78a2e42d57677fa8032a2d430a97bfab62f955b2a9440b61eeb2ef439f2
SSDEEP

768:PGjFt+BHkIaydteDAu/1RTpkavHatEWRWeUcQtEXgLa1V6:+hvxgwce9LaP

Score

1^/10

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2092	Rundll32.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2092	Rundll32.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2344 wrote to memory of 2348	2344	regsvr32.exe	31
PID 2344 wrote to memory of 2348	2344	regsvr32.exe	31
PID 2344 wrote to memory of 2348	2344	regsvr32.exe	31
PID 2344 wrote to memory of 2348	2344	regsvr32.exe	31
PID 2344 wrote to memory of 2348	2344	regsvr32.exe	31
PID 2344 wrote to memory of 2348	2344	regsvr32.exe	31
PID 2344 wrote to memory of 2348	2344	regsvr32.exe	31
PID 2348 wrote to memory of 2092	2348	regsvr32.exe	32
PID 2348 wrote to memory of 2092	2348	regsvr32.exe	32
PID 2348 wrote to memory of 2092	2348	regsvr32.exe	32
PID 2348 wrote to memory of 2092	2348	regsvr32.exe	32
PID 2348 wrote to memory of 2092	2348	regsvr32.exe	32
PID 2348 wrote to memory of 2092	2348	regsvr32.exe	32
PID 2348 wrote to memory of 2092	2348	regsvr32.exe	32

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\42849b0c3ee88ffe16233fdb1385da34_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2344
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\42849b0c3ee88ffe16233fdb1385da34_JaffaCakes118.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2348
- - C:\Windows\SysWOW64\Rundll32.exe
    C:\Windows\system32\Rundll32.exe C:\Users\Admin\AppData\Local\Temp\42849b0c3ee88ffe16233fdb1385da34_JaffaCakes118.dll,DllUnregisterServer
    3⤵
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    PID:2092