3dae5e2a2de31bda59e5df45e484340cdde4f4d710cbed479b0908bf1ee27f70

Analysis

max time kernel
13s
max time network
19s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
13/07/2024, 19:43

Target

43156b812c80e9e45061ec024bfbbbb0_JaffaCakes118.dll
Size

140KB
MD5

43156b812c80e9e45061ec024bfbbbb0
SHA1

0f9373ad7137559797443b794d11676addc5f11c
SHA256

3dae5e2a2de31bda59e5df45e484340cdde4f4d710cbed479b0908bf1ee27f70
SHA512

884fb801b11d22c682e01c89b49e51a6f356d6e195b7688970fca0dc010a279df276fed6fdd761f4c4791b98e9d4955242f677cc2f2a087f03dc244cf544434c
SSDEEP

3072:DfyjfBAAU9H1H/N0SONP22kQNMP8COpJ+wmhQH:D2rEVfGPBBMkRWXKH

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1140 wrote to memory of 2364	1140	regsvr32.exe	30
PID 1140 wrote to memory of 2364	1140	regsvr32.exe	30
PID 1140 wrote to memory of 2364	1140	regsvr32.exe	30
PID 1140 wrote to memory of 2364	1140	regsvr32.exe	30
PID 1140 wrote to memory of 2364	1140	regsvr32.exe	30
PID 1140 wrote to memory of 2364	1140	regsvr32.exe	30
PID 1140 wrote to memory of 2364	1140	regsvr32.exe	30

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\43156b812c80e9e45061ec024bfbbbb0_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1140
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\43156b812c80e9e45061ec024bfbbbb0_JaffaCakes118.dll
  2⤵
  PID:2364