c850ba8bd11fbc5df3bece177adb6acb97f832b19964b0ea6599438b244f140f

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
19/07/2024, 16:21

Target

5cb59b86bf7c838fe0bb76276cebc5b8_JaffaCakes118.dll
Size

48KB
MD5

5cb59b86bf7c838fe0bb76276cebc5b8
SHA1

7709fefdfb2eb81f0f37297fbfa50c22b4be0470
SHA256

c850ba8bd11fbc5df3bece177adb6acb97f832b19964b0ea6599438b244f140f
SHA512

fc44c9f5cb4f53f2cde009ade7ff057a4f5101542b2766809ec793ed2cea237ce472ddc530663ae9369a946384800f81dbebf10340c98137f4d332096525b251
SSDEEP

768:5JqFgOvH6CISzuKvcLXs8AGPoIfNfvI0mOYbZVou9y2JuUQ37ty8G:5gCSTcL8uPoIVfvT/60ZdU8

Score

1^/10

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2756	Rundll32.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2756	Rundll32.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 3004 wrote to memory of 1304	3004	regsvr32.exe	30
PID 3004 wrote to memory of 1304	3004	regsvr32.exe	30
PID 3004 wrote to memory of 1304	3004	regsvr32.exe	30
PID 3004 wrote to memory of 1304	3004	regsvr32.exe	30
PID 3004 wrote to memory of 1304	3004	regsvr32.exe	30
PID 3004 wrote to memory of 1304	3004	regsvr32.exe	30
PID 3004 wrote to memory of 1304	3004	regsvr32.exe	30
PID 1304 wrote to memory of 2756	1304	regsvr32.exe	31
PID 1304 wrote to memory of 2756	1304	regsvr32.exe	31
PID 1304 wrote to memory of 2756	1304	regsvr32.exe	31
PID 1304 wrote to memory of 2756	1304	regsvr32.exe	31
PID 1304 wrote to memory of 2756	1304	regsvr32.exe	31
PID 1304 wrote to memory of 2756	1304	regsvr32.exe	31
PID 1304 wrote to memory of 2756	1304	regsvr32.exe	31

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\5cb59b86bf7c838fe0bb76276cebc5b8_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3004
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\5cb59b86bf7c838fe0bb76276cebc5b8_JaffaCakes118.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1304
- - C:\Windows\SysWOW64\Rundll32.exe
    C:\Windows\system32\Rundll32.exe C:\Users\Admin\AppData\Local\Temp\5cb59b86bf7c838fe0bb76276cebc5b8_JaffaCakes118.dll,DllUnregisterServer
    3⤵
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    PID:2756