eb0e8c8abff9e73bbfadc73a84375e78f7c036d9906f9c3ea933b68b27b5bd35

Analysis

max time kernel
16s
max time network
17s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
15/07/2024, 01:59

Target

47bdecf5c675dfce369fb1c046b161cd_JaffaCakes118.dll
Size

18KB
MD5

47bdecf5c675dfce369fb1c046b161cd
SHA1

64dbe4e78687149fce32d99a1964e64fbe04f850
SHA256

eb0e8c8abff9e73bbfadc73a84375e78f7c036d9906f9c3ea933b68b27b5bd35
SHA512

8c7cdf06986d4ee6d39b780f1d86890bf17d77da431136f5461c5948784566fc75e451e3c5875c3b3e7d256f813523f1c4b8cf23dec6efd966e3ba78105c1471
SSDEEP

384:RCBrE88OjO5HuXk17j3Bx+WgAMyIiTiYh5ITitF1wNnISeczQ3/8fzWlI:cBY8bC5OUNbUAblTBIKyISnzQvyUI

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2320 wrote to memory of 2324	2320	regsvr32.exe	29
PID 2320 wrote to memory of 2324	2320	regsvr32.exe	29
PID 2320 wrote to memory of 2324	2320	regsvr32.exe	29
PID 2320 wrote to memory of 2324	2320	regsvr32.exe	29
PID 2320 wrote to memory of 2324	2320	regsvr32.exe	29
PID 2320 wrote to memory of 2324	2320	regsvr32.exe	29
PID 2320 wrote to memory of 2324	2320	regsvr32.exe	29

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\47bdecf5c675dfce369fb1c046b161cd_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2320
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\47bdecf5c675dfce369fb1c046b161cd_JaffaCakes118.dll
  2⤵
  PID:2324

memory/2324-0-0x00000000001F0000-0x0000000000201000-memory.dmp

Filesize
68KB

Download