404438cb68decd6310a878c62bb22d9930458a9840921d1b7af0c966c6411a6e

Analysis

max time kernel
117s
max time network
117s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
15/07/2024, 06:29

Target

489cb09302c3fddbf26c1e6e293adf86_JaffaCakes118.dll
Size

86KB
MD5

489cb09302c3fddbf26c1e6e293adf86
SHA1

b818a9e5ad3baf24f9716611495030d156001d91
SHA256

404438cb68decd6310a878c62bb22d9930458a9840921d1b7af0c966c6411a6e
SHA512

c5e3a491baf03ec6074f4f9a42ec7c8a329626d0183d8b72b537a718a93ecde6a8367b4393e7ce2591d77acd3370ffa8b7f7f7e5e982b708ac5e833b438dbace
SSDEEP

1536:2uf+30IAzm/91jJ+0oscMuSipQMKXPIQ+/E0iZXCupk3p82oL38s:Wmssy9Tia/+/fiZ3k3p81

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2396 wrote to memory of 2564	2396	regsvr32.exe	30
PID 2396 wrote to memory of 2564	2396	regsvr32.exe	30
PID 2396 wrote to memory of 2564	2396	regsvr32.exe	30
PID 2396 wrote to memory of 2564	2396	regsvr32.exe	30
PID 2396 wrote to memory of 2564	2396	regsvr32.exe	30
PID 2396 wrote to memory of 2564	2396	regsvr32.exe	30
PID 2396 wrote to memory of 2564	2396	regsvr32.exe	30

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\489cb09302c3fddbf26c1e6e293adf86_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2396
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\489cb09302c3fddbf26c1e6e293adf86_JaffaCakes118.dll
  2⤵
  PID:2564

memory/2564-0-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download