d395e54189c789d811de1941e8bf75d36e0ffb7d0ff1e0aa5c30f47cadcb5927

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
13-07-2024 17:15

Target

429c5066f8b239caa2ea68edc2c12e0d_JaffaCakes118.dll
Size

68KB
MD5

429c5066f8b239caa2ea68edc2c12e0d
SHA1

0738a1bc16d7594cd5d1792f331dfb7ea0c0fc0e
SHA256

d395e54189c789d811de1941e8bf75d36e0ffb7d0ff1e0aa5c30f47cadcb5927
SHA512

75462bd945cf694d1d5731a43992bf5ddd03487170aca854399432f8d914a8b39b22b6a4e95fa5013e29e6de5aba626944f43fe2f44be358d8f01385ead4507c
SSDEEP

1536:4tMqaObQ7piNWIcbiHCj/d0NvHjWh2BNbzJp2AVgDraZ:k9LOXwvHjWh2BNp0TmZ

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2072 wrote to memory of 2632	2072	regsvr32.exe	30
PID 2072 wrote to memory of 2632	2072	regsvr32.exe	30
PID 2072 wrote to memory of 2632	2072	regsvr32.exe	30
PID 2072 wrote to memory of 2632	2072	regsvr32.exe	30
PID 2072 wrote to memory of 2632	2072	regsvr32.exe	30
PID 2072 wrote to memory of 2632	2072	regsvr32.exe	30
PID 2072 wrote to memory of 2632	2072	regsvr32.exe	30

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\429c5066f8b239caa2ea68edc2c12e0d_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2072
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\429c5066f8b239caa2ea68edc2c12e0d_JaffaCakes118.dll
  2⤵
  PID:2632

memory/2632-0-0x0000000000350000-0x0000000000367000-memory.dmp

Filesize
92KB

Download