748f51c10cfa4ca818b1528dce17e6bb4f866a9bfd498af72fa68ed9f28be554

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
15-07-2024 19:25

Target

4b136db6cbe7cf8f3f046ed8a71dea55_JaffaCakes118.dll
Size

843KB
MD5

4b136db6cbe7cf8f3f046ed8a71dea55
SHA1

b7489a92ceefddfbc7f79a9c6345989e4a481877
SHA256

748f51c10cfa4ca818b1528dce17e6bb4f866a9bfd498af72fa68ed9f28be554
SHA512

9472e3534f61322ea24592d43d5c242284903f380141d7320439f5879ca5fe6f45243d505cd5dc74a07dc03fb1495f31ab1f73be35c9f6755e77e99b5ddca4ad
SSDEEP

12288:+ahjP5R/1Pw+p83iHDqQyykPfZhpHUmBvj0KML8tf8j:+aLRNPPp83ijGLddU

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 2116 wrote to memory of 2892	2116	regsvr32.exe	regsvr32.exe
PID 2116 wrote to memory of 2892	2116	regsvr32.exe	regsvr32.exe
PID 2116 wrote to memory of 2892	2116	regsvr32.exe	regsvr32.exe
PID 2116 wrote to memory of 2892	2116	regsvr32.exe	regsvr32.exe
PID 2116 wrote to memory of 2892	2116	regsvr32.exe	regsvr32.exe
PID 2116 wrote to memory of 2892	2116	regsvr32.exe	regsvr32.exe
PID 2116 wrote to memory of 2892	2116	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\4b136db6cbe7cf8f3f046ed8a71dea55_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2116
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\4b136db6cbe7cf8f3f046ed8a71dea55_JaffaCakes118.dll
  2⤵
  PID:2892

memory/2892-0-0x0000000001E30000-0x0000000001F08000-memory.dmp

Filesize
864KB

Download
memory/2892-1-0x0000000001E31000-0x0000000001E3A000-memory.dmp

Filesize
36KB

Download