4ec645da730f1bcae05a9ff42fc06df463eb625dae01587c1f84e8890bfc3b07

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
16/07/2024, 06:29

Target

4d2ab15135a59694a1cc46ada5020fb1_JaffaCakes118.dll
Size

91KB
MD5

4d2ab15135a59694a1cc46ada5020fb1
SHA1

fe706d003bf1a8a5667d5c59dbc4fb535cde18b6
SHA256

4ec645da730f1bcae05a9ff42fc06df463eb625dae01587c1f84e8890bfc3b07
SHA512

faa8b2a7cedbffe038aab5d337e083446ccb7f27f7e55c40fe79b9e78096af14ff2b0d08c6f33764e0a9ac2149ddb631be9032b096d5fdf1c900b95c4051bca1
SSDEEP

1536:V2/7gCuQ//Mh/zW3iQdJL3ZMe5fpiMJa7k9ieW8KBqIkn4NeoRUflWlDHAU53iQc:V2zGQ/EhLUiQPtfpRaMW8JIU4UoOW9gT

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1356 wrote to memory of 2092	1356	regsvr32.exe	31
PID 1356 wrote to memory of 2092	1356	regsvr32.exe	31
PID 1356 wrote to memory of 2092	1356	regsvr32.exe	31
PID 1356 wrote to memory of 2092	1356	regsvr32.exe	31
PID 1356 wrote to memory of 2092	1356	regsvr32.exe	31
PID 1356 wrote to memory of 2092	1356	regsvr32.exe	31
PID 1356 wrote to memory of 2092	1356	regsvr32.exe	31

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\4d2ab15135a59694a1cc46ada5020fb1_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1356
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\4d2ab15135a59694a1cc46ada5020fb1_JaffaCakes118.dll
  2⤵
  PID:2092

memory/2092-0-0x0000000000530000-0x0000000000576000-memory.dmp

Filesize
280KB

Download