f5aa0b790aa27dea53ee0b52d5e0021203fab7fcbc7fb4dfe4a8f5e3ae0e51bd

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
14/07/2024, 16:27

Target

469ba8846fef1133140ecb3619963ef2_JaffaCakes118.dll
Size

82KB
MD5

469ba8846fef1133140ecb3619963ef2
SHA1

2beb1361ce44f083c237a73fb9a7361b822a0e0a
SHA256

f5aa0b790aa27dea53ee0b52d5e0021203fab7fcbc7fb4dfe4a8f5e3ae0e51bd
SHA512

ee9f6ac33eb46c92a1af68238b374df281bf9fd3781fc2e8f96e381b3dff3618a1e8d31c0916e5bb1f73fae15323515df29fd2cd8b3147381508c6e1e8713aaa
SSDEEP

1536:VU3CncWng22SFLIRQa8QRPF0h8k79Pl5E0HW6pOYST6V5Fq3o5pGVSyRl:VcGRJF8OgRPFidkFT4G3oOSyL

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3020 wrote to memory of 2640	3020	regsvr32.exe	30
PID 3020 wrote to memory of 2640	3020	regsvr32.exe	30
PID 3020 wrote to memory of 2640	3020	regsvr32.exe	30
PID 3020 wrote to memory of 2640	3020	regsvr32.exe	30
PID 3020 wrote to memory of 2640	3020	regsvr32.exe	30
PID 3020 wrote to memory of 2640	3020	regsvr32.exe	30
PID 3020 wrote to memory of 2640	3020	regsvr32.exe	30

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\469ba8846fef1133140ecb3619963ef2_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3020
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\469ba8846fef1133140ecb3619963ef2_JaffaCakes118.dll
  2⤵
  PID:2640

memory/2640-0-0x0000000000280000-0x00000000002BE000-memory.dmp

Filesize
248KB

Download