40ffda8d8cb1311a91bfb6cc164f0b5ce3f0605846d5d9db4fd9dcaad1b2975e

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
15/07/2024, 11:55

Target

49ab8e42be2ac3bd8efc342a222b48ed_JaffaCakes118.dll
Size

105KB
MD5

49ab8e42be2ac3bd8efc342a222b48ed
SHA1

4e2d168d113c905c1791f4f5d0c8bd3585a52e7a
SHA256

40ffda8d8cb1311a91bfb6cc164f0b5ce3f0605846d5d9db4fd9dcaad1b2975e
SHA512

fde783a95e40bdcbea98b7433b31277b7c6ea1869429ddc7a0d7efb2e8ccf720731d6a6bdbba95e460e4da5af38a59f456cd2adf177cf6a50409987b6914e419
SSDEEP

1536:DMqzW7JoS7qxgY96riqT2KazWkokkkkkkotV74wooRBemxQ6ph5l:D5OK1bzWkokkkkkkcVUwooRUmx3

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2260 wrote to memory of 2644	2260	regsvr32.exe	30
PID 2260 wrote to memory of 2644	2260	regsvr32.exe	30
PID 2260 wrote to memory of 2644	2260	regsvr32.exe	30
PID 2260 wrote to memory of 2644	2260	regsvr32.exe	30
PID 2260 wrote to memory of 2644	2260	regsvr32.exe	30
PID 2260 wrote to memory of 2644	2260	regsvr32.exe	30
PID 2260 wrote to memory of 2644	2260	regsvr32.exe	30

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\49ab8e42be2ac3bd8efc342a222b48ed_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2260
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\49ab8e42be2ac3bd8efc342a222b48ed_JaffaCakes118.dll
  2⤵
  PID:2644

memory/2644-0-0x0000000010000000-0x000000001001A000-memory.dmp

Filesize
104KB

Download