0378541eb5230f4252f89d09b5b8bd604eb122f2048d2000b9da5a1ebd3854c2

Analysis

max time kernel
14s
max time network
19s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
19/07/2024, 20:40

Target

5d94ee8d3323cd04fbf419ad074b409e_JaffaCakes118.dll
Size

584KB
MD5

5d94ee8d3323cd04fbf419ad074b409e
SHA1

f14548ed7adbda1b67b63199a83a30671e73eacd
SHA256

0378541eb5230f4252f89d09b5b8bd604eb122f2048d2000b9da5a1ebd3854c2
SHA512

2b170a39f47ae1c3d31344bbb939700979a0ddb4937d320acc46643def02cfa1de545acd99a539c45ebd4a85b460ebc5c9d63be949954d01cbabec357d05d14f
SSDEEP

6144:Zd0v8gn6RO1dRLqYEFdq0E3wn5XELF4MGpbb992tzlZffgnT9AgDz53xPHn929vD:Zd0KY1PuYEFOoXo6TNkrUZhE+VGtv

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 760 wrote to memory of 1164	760	regsvr32.exe	29
PID 760 wrote to memory of 1164	760	regsvr32.exe	29
PID 760 wrote to memory of 1164	760	regsvr32.exe	29
PID 760 wrote to memory of 1164	760	regsvr32.exe	29
PID 760 wrote to memory of 1164	760	regsvr32.exe	29
PID 760 wrote to memory of 1164	760	regsvr32.exe	29
PID 760 wrote to memory of 1164	760	regsvr32.exe	29

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\5d94ee8d3323cd04fbf419ad074b409e_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:760
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\5d94ee8d3323cd04fbf419ad074b409e_JaffaCakes118.dll
  2⤵
  PID:1164