04ab7b98b1b1c92482545f2ec33523dde3e369c894d9b552c62231cc3e0678ec

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
16/07/2024, 04:35

Target

4cd1d332d2f6e4a3eb7072be5c19c618_JaffaCakes118.dll
Size

167KB
MD5

4cd1d332d2f6e4a3eb7072be5c19c618
SHA1

4cc12f29e93b068e2db39f7a33319409aee99576
SHA256

04ab7b98b1b1c92482545f2ec33523dde3e369c894d9b552c62231cc3e0678ec
SHA512

020ff6857d2488b75859f029eb88d1b3e2807d727a951b7b4c4ecc9196e743e608e95863c929b558eb813afdd5265df7ffceb261b3cdf5a8c557857348befdf9
SSDEEP

3072:apoue6JBetB8D+ly+xLV6KCzE7fQ6haM:apzTBeQyxh6KCzE79

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2400 wrote to memory of 2428	2400	regsvr32.exe	30
PID 2400 wrote to memory of 2428	2400	regsvr32.exe	30
PID 2400 wrote to memory of 2428	2400	regsvr32.exe	30
PID 2400 wrote to memory of 2428	2400	regsvr32.exe	30
PID 2400 wrote to memory of 2428	2400	regsvr32.exe	30
PID 2400 wrote to memory of 2428	2400	regsvr32.exe	30
PID 2400 wrote to memory of 2428	2400	regsvr32.exe	30

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\4cd1d332d2f6e4a3eb7072be5c19c618_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2400
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\4cd1d332d2f6e4a3eb7072be5c19c618_JaffaCakes118.dll
  2⤵
  PID:2428