04639ca0ef84975dec49a2600693326ccbb0bda2d2c6f04dcc93f366ae2f5549

Analysis

max time kernel
122s
max time network
124s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
15-07-2024 13:53

Target

49f700ed2441be347ee14cbedc90abf6_JaffaCakes118.dll
Size

2.3MB
MD5

49f700ed2441be347ee14cbedc90abf6
SHA1

c69333764cb00dc707816d866f018078bfd64a58
SHA256

04639ca0ef84975dec49a2600693326ccbb0bda2d2c6f04dcc93f366ae2f5549
SHA512

4f49f3bf02ad46520dad1f5d248b55d52043493eb26f778f32da03961de9fd064eb64aea7e9e18bc1a04b9338e0b8b8919efc91bb8fad0398219e905d1aae303
SSDEEP

49152:mwdwvVkFsUN2uEcpI75b3/cwnuIrmLPoBPJf6lT2MiG:WvVANIuEgQ3/1gDoBhfC2MiG

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1688 wrote to memory of 2400	1688	regsvr32.exe	30
PID 1688 wrote to memory of 2400	1688	regsvr32.exe	30
PID 1688 wrote to memory of 2400	1688	regsvr32.exe	30
PID 1688 wrote to memory of 2400	1688	regsvr32.exe	30
PID 1688 wrote to memory of 2400	1688	regsvr32.exe	30
PID 1688 wrote to memory of 2400	1688	regsvr32.exe	30
PID 1688 wrote to memory of 2400	1688	regsvr32.exe	30

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\49f700ed2441be347ee14cbedc90abf6_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1688
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\49f700ed2441be347ee14cbedc90abf6_JaffaCakes118.dll
  2⤵
  PID:2400

memory/2400-0-0x0000000000B30000-0x0000000000CDB000-memory.dmp

Filesize
1.7MB

Download
memory/2400-1-0x0000000000B30000-0x0000000000CDB000-memory.dmp

Filesize
1.7MB

Download