9b59f24ae84ae960572f57d5f387458694616e3d1ef38803db7c0bc1b533b32c

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
19/07/2024, 19:43

Target

5d66b083763e0e1f15410992c9403b44_JaffaCakes118.dll
Size

322KB
MD5

5d66b083763e0e1f15410992c9403b44
SHA1

8cb5b65242a04ba8a62f7cf8f06ca2f9a9dd2191
SHA256

9b59f24ae84ae960572f57d5f387458694616e3d1ef38803db7c0bc1b533b32c
SHA512

694829c66830fcae4912f7190e0e6923851ec077641c1fc683e855df350bea5729748dcd27f7118ff76088b1142aa1ea515fd2ae83c04e9ed67f44fd87973e30
SSDEEP

6144:ntAdR/24/tMAKby0aBXjjYZ09pjzGkDyLnW79yE:tA//2Etuby/Wyhrj9y

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1816 wrote to memory of 3040	1816	regsvr32.exe	30
PID 1816 wrote to memory of 3040	1816	regsvr32.exe	30
PID 1816 wrote to memory of 3040	1816	regsvr32.exe	30
PID 1816 wrote to memory of 3040	1816	regsvr32.exe	30
PID 1816 wrote to memory of 3040	1816	regsvr32.exe	30
PID 1816 wrote to memory of 3040	1816	regsvr32.exe	30
PID 1816 wrote to memory of 3040	1816	regsvr32.exe	30

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\5d66b083763e0e1f15410992c9403b44_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1816
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\5d66b083763e0e1f15410992c9403b44_JaffaCakes118.dll
  2⤵
  PID:3040

memory/3040-0-0x0000000074EA0000-0x0000000074EF7000-memory.dmp

Filesize
348KB

Download