0d952445bedb2b5fcdc14105f31aa4322b5f0284c33e3cfe871cf789a1515fef

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
14-07-2024 08:50

Target

451dee7d1344de2071287178caf4f7f7_JaffaCakes118.dll
Size

30KB
MD5

451dee7d1344de2071287178caf4f7f7
SHA1

519641dadd285f455ff2a5ba1b85ede9f28f72da
SHA256

0d952445bedb2b5fcdc14105f31aa4322b5f0284c33e3cfe871cf789a1515fef
SHA512

08335113a5ec0ba6b7ba37b98360a7de169fc6e992575d5266ec5075cf73473e7a7d0a7cae13a067c7719529793595fbb5d5de44b5b5ac79b513abcbc814c376
SSDEEP

384:K59+PbhI7kZp9W/ACSrRqA2BKg31GztPnuGy1gjM38HxAw09qbs8sIHvB0N5B:y+ThI7G/hv2IBPuG8gjrJ09Sswvm

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2224 wrote to memory of 2004	2224	regsvr32.exe	28
PID 2224 wrote to memory of 2004	2224	regsvr32.exe	28
PID 2224 wrote to memory of 2004	2224	regsvr32.exe	28
PID 2224 wrote to memory of 2004	2224	regsvr32.exe	28
PID 2224 wrote to memory of 2004	2224	regsvr32.exe	28
PID 2224 wrote to memory of 2004	2224	regsvr32.exe	28
PID 2224 wrote to memory of 2004	2224	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\451dee7d1344de2071287178caf4f7f7_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2224
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\451dee7d1344de2071287178caf4f7f7_JaffaCakes118.dll
  2⤵
  PID:2004

memory/2004-0-0x0000000000170000-0x000000000017D000-memory.dmp

Filesize
52KB

Download