8c6d0c9a36191a94c3bc8e8d21b10d61a8f8027da24f5950dd90e9f0204c8650

Analysis

max time kernel
13s
max time network
19s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
14/07/2024, 11:38

Target

45a72f0b823f99dee530f5ff9a4ac01b_JaffaCakes118.dll
Size

120KB
MD5

45a72f0b823f99dee530f5ff9a4ac01b
SHA1

1369c03f0e0779839bd2e1907dcc8730a7a141f8
SHA256

8c6d0c9a36191a94c3bc8e8d21b10d61a8f8027da24f5950dd90e9f0204c8650
SHA512

797547b4ae6c58a0177be9052d259f36d1140b9c159235d2074e13204540c2b2a6cdb6a604d21d92e29bd5c7c189b7b1c9bdc2209bd5d761c187b7fe09fecffa
SSDEEP

3072:EwSbYrbSWaU7q/9YU09VmifK7W4flzN3EqpjiqFepyO:pXmU8p06ZN3gqF

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2012 wrote to memory of 2040	2012	regsvr32.exe	30
PID 2012 wrote to memory of 2040	2012	regsvr32.exe	30
PID 2012 wrote to memory of 2040	2012	regsvr32.exe	30
PID 2012 wrote to memory of 2040	2012	regsvr32.exe	30
PID 2012 wrote to memory of 2040	2012	regsvr32.exe	30
PID 2012 wrote to memory of 2040	2012	regsvr32.exe	30
PID 2012 wrote to memory of 2040	2012	regsvr32.exe	30

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\45a72f0b823f99dee530f5ff9a4ac01b_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2012
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\45a72f0b823f99dee530f5ff9a4ac01b_JaffaCakes118.dll
  2⤵
  PID:2040

memory/2040-0-0x00000000001C0000-0x00000000001E3000-memory.dmp

Filesize
140KB

Download