e59ee74c6773410700521d7d60ebce7017b086e0f438daf1612403b9adf80264

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
16-07-2024 00:55

Target

4c26a5158c8fd7d4a44486404de41e09_JaffaCakes118.dll
Size

2.1MB
MD5

4c26a5158c8fd7d4a44486404de41e09
SHA1

8340700b72e76910fc715fb069581c4984e5829f
SHA256

e59ee74c6773410700521d7d60ebce7017b086e0f438daf1612403b9adf80264
SHA512

6826d6fdb29d4d630be9d92fa967bcedc33861fbbebd8df67f7065a293a737f877e3addca8acef6a1c98cdbc893752c6d8f7bf3210ba50eb7b1be4ad29239f7f
SSDEEP

49152:+IsZgmtfiBTkMHKvEQzsIuqh14hYSTYQ22Q:+qCQHKvECsIL1UC

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2584 wrote to memory of 1792	2584	regsvr32.exe	30
PID 2584 wrote to memory of 1792	2584	regsvr32.exe	30
PID 2584 wrote to memory of 1792	2584	regsvr32.exe	30
PID 2584 wrote to memory of 1792	2584	regsvr32.exe	30
PID 2584 wrote to memory of 1792	2584	regsvr32.exe	30
PID 2584 wrote to memory of 1792	2584	regsvr32.exe	30
PID 2584 wrote to memory of 1792	2584	regsvr32.exe	30

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\4c26a5158c8fd7d4a44486404de41e09_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2584
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\4c26a5158c8fd7d4a44486404de41e09_JaffaCakes118.dll
  2⤵
  PID:1792