982a3e2aa5a63af883b7227c166d10c518a914fdb3f7102e374fc955ba55a41c

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
15/07/2024, 23:22

Target

4bd9c487f38b5123e1c47e562d5ba298_JaffaCakes118.dll
Size

163KB
MD5

4bd9c487f38b5123e1c47e562d5ba298
SHA1

6bf60d3c029da5630d6cb85f59edcc5d4fff7148
SHA256

982a3e2aa5a63af883b7227c166d10c518a914fdb3f7102e374fc955ba55a41c
SHA512

ad5af34485e6f99591d4b625a1f69bc8d9606ea99f794f8d4f9c26752f853c0c589376a50964bcd15373152706e2bfeb0e02e61a70618e5de48a7cbc6db76d1b
SSDEEP

3072:EUFZ68KM68KM68KM68KM68KM68KM68KM6r6KEuUa7NI:EITKMTKMTKMTKMTKMTKMTKMa6ENI

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2408 wrote to memory of 304	2408	regsvr32.exe	30
PID 2408 wrote to memory of 304	2408	regsvr32.exe	30
PID 2408 wrote to memory of 304	2408	regsvr32.exe	30
PID 2408 wrote to memory of 304	2408	regsvr32.exe	30
PID 2408 wrote to memory of 304	2408	regsvr32.exe	30
PID 2408 wrote to memory of 304	2408	regsvr32.exe	30
PID 2408 wrote to memory of 304	2408	regsvr32.exe	30

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\4bd9c487f38b5123e1c47e562d5ba298_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2408
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\4bd9c487f38b5123e1c47e562d5ba298_JaffaCakes118.dll
  2⤵
  PID:304

memory/304-0-0x0000000000190000-0x00000000001A4000-memory.dmp

Filesize
80KB

Download