94699176482565587dc4ae98c347a7ea0a886987ca978932a296b235a23c0f9a

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
15/07/2024, 05:46

Target

48791b2196dd7784e8b5b59da128689a_JaffaCakes118.dll
Size

158KB
MD5

48791b2196dd7784e8b5b59da128689a
SHA1

0dacb99be7fea24dbeeb03fe6715f82fd38eec74
SHA256

94699176482565587dc4ae98c347a7ea0a886987ca978932a296b235a23c0f9a
SHA512

5ad8809c27fd5e25e538fd71e96682ba6280a4d8ba28dffc4f4a182bb4a27a6a7c50d3c21ef2cf8ab766b6b4401fd9d9e8d3f1ed4fa1f0e3917d37eda34c4973
SSDEEP

3072:wQ0ukp3TyE2M0Tu9HDH0617/J3DN6OoN5QwCGTu9:BIpjRToGL0617T6H599G

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2476 wrote to memory of 1316	2476	regsvr32.exe	31
PID 2476 wrote to memory of 1316	2476	regsvr32.exe	31
PID 2476 wrote to memory of 1316	2476	regsvr32.exe	31
PID 2476 wrote to memory of 1316	2476	regsvr32.exe	31
PID 2476 wrote to memory of 1316	2476	regsvr32.exe	31
PID 2476 wrote to memory of 1316	2476	regsvr32.exe	31
PID 2476 wrote to memory of 1316	2476	regsvr32.exe	31

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\48791b2196dd7784e8b5b59da128689a_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2476
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\48791b2196dd7784e8b5b59da128689a_JaffaCakes118.dll
  2⤵
  PID:1316

memory/1316-0-0x0000000000190000-0x00000000001D3000-memory.dmp

Filesize
268KB

Download