5b1aabd9597a77aa2c08d98fb9e15e382703c33d9f8dd0c68625f3e242976836

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
15/07/2024, 23:36

Target

4be5484d0307c8918b776098b6a2d765_JaffaCakes118.dll
Size

32KB
MD5

4be5484d0307c8918b776098b6a2d765
SHA1

f8c916f48baae4ce88cbe3715da509853b754f27
SHA256

5b1aabd9597a77aa2c08d98fb9e15e382703c33d9f8dd0c68625f3e242976836
SHA512

84cb12effb62e4b66cd053b21d454d6fb9bc7cb92bb93ebd9a508d5f3e9c457c77301fc93be86459e09afde2e9e5e63c77900b06e5344be25500647248ab4d91
SSDEEP

384:B59+PbhI7kZp9LDS+AkenZG9FpxFVUy42XE32QF8W7Z/0tShk4xD8sIH2qVZHk:5+ThI7Gjfxgy4o6rDZ0tSu4xYswDZE

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1916 wrote to memory of 1924	1916	regsvr32.exe	28
PID 1916 wrote to memory of 1924	1916	regsvr32.exe	28
PID 1916 wrote to memory of 1924	1916	regsvr32.exe	28
PID 1916 wrote to memory of 1924	1916	regsvr32.exe	28
PID 1916 wrote to memory of 1924	1916	regsvr32.exe	28
PID 1916 wrote to memory of 1924	1916	regsvr32.exe	28
PID 1916 wrote to memory of 1924	1916	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\4be5484d0307c8918b776098b6a2d765_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1916
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\4be5484d0307c8918b776098b6a2d765_JaffaCakes118.dll
  2⤵
  PID:1924

memory/1924-0-0x0000000000170000-0x000000000017D000-memory.dmp

Filesize
52KB

Download