c90fc80c983647f4aaf1a9c69e7aca4610f69244455d7212f1b18796d69893ab

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
19/07/2024, 11:26

Target

5bbe3fa2454c62fd685071d50827e9bb_JaffaCakes118.dll
Size

388KB
MD5

5bbe3fa2454c62fd685071d50827e9bb
SHA1

f3b46d2cb732ebb55365ebc2dcf2fef3707cf5ee
SHA256

c90fc80c983647f4aaf1a9c69e7aca4610f69244455d7212f1b18796d69893ab
SHA512

41a3727a562bcdd26a02c879291bbbcf968c3659bb4b4d160f9ecb516e707353ef475bb51380ef1ffca53d4c882c3c38c64d6d3747c94d48d455a2b11d223e74
SSDEEP

6144:37wM9t1BWNta+BljIF/pfld2L4n2mdk9phGxbU:37wM9HBah3jIF/NLo42mdk9N

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2772 wrote to memory of 2808	2772	regsvr32.exe	30
PID 2772 wrote to memory of 2808	2772	regsvr32.exe	30
PID 2772 wrote to memory of 2808	2772	regsvr32.exe	30
PID 2772 wrote to memory of 2808	2772	regsvr32.exe	30
PID 2772 wrote to memory of 2808	2772	regsvr32.exe	30
PID 2772 wrote to memory of 2808	2772	regsvr32.exe	30
PID 2772 wrote to memory of 2808	2772	regsvr32.exe	30

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\5bbe3fa2454c62fd685071d50827e9bb_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2772
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\5bbe3fa2454c62fd685071d50827e9bb_JaffaCakes118.dll
  2⤵
  PID:2808