34bbbba8e0e469bafd1a1851b885084dfbf2e4ea96558a370d2d60daa537ec34

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
15-07-2024 08:25

Target

48fc84c72a179d5716bf690636b5cf1d_JaffaCakes118.dll
Size

208KB
MD5

48fc84c72a179d5716bf690636b5cf1d
SHA1

b8d4d99833eb393e896d961294adfffe17636e47
SHA256

34bbbba8e0e469bafd1a1851b885084dfbf2e4ea96558a370d2d60daa537ec34
SHA512

0a77ad7600ff8bb4406f1f3441b97917f0e7898bdd0179d586ec888b3285ac1a60dd66b423c25c5ed6754019e243e49378340fce5d0f4dcc394917209ca49603
SSDEEP

1536:eHJLDtgABkVkcvxOIe6+UP8CW5PfIMOIbpbw2mNWuYw+NaD7BaX3sH0Uqy9Wt0t3:epibycv8nIMOIbpbo7gE0Xy9E0Ypi

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2760 wrote to memory of 2824	2760	regsvr32.exe	31
PID 2760 wrote to memory of 2824	2760	regsvr32.exe	31
PID 2760 wrote to memory of 2824	2760	regsvr32.exe	31
PID 2760 wrote to memory of 2824	2760	regsvr32.exe	31
PID 2760 wrote to memory of 2824	2760	regsvr32.exe	31
PID 2760 wrote to memory of 2824	2760	regsvr32.exe	31
PID 2760 wrote to memory of 2824	2760	regsvr32.exe	31

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\48fc84c72a179d5716bf690636b5cf1d_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2760
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\48fc84c72a179d5716bf690636b5cf1d_JaffaCakes118.dll
  2⤵
  PID:2824

memory/2824-0-0x0000000000130000-0x000000000013D000-memory.dmp

Filesize
52KB

Download
memory/2824-5-0x0000000000130000-0x000000000013D000-memory.dmp

Filesize
52KB

Download
memory/2824-4-0x000000005EDFA000-0x000000005EDFD000-memory.dmp

Filesize
12KB

Download
memory/2824-3-0x00000000000E0000-0x00000000000ED000-memory.dmp

Filesize
52KB

Download
memory/2824-2-0x000000005EDF1000-0x000000005EDFE000-memory.dmp

Filesize
52KB

Download