22ac79827f84775e1d7e29d30be9d6db54aa27305473506fb107364fc1a651c2

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
20/07/2024, 03:20

Target

5ed5d18ea4c2cbf9d33e9a96a052a28b_JaffaCakes118.exe
Size

331KB
MD5

5ed5d18ea4c2cbf9d33e9a96a052a28b
SHA1

a0c08d4305d897828f4872a68c27bc15d5970655
SHA256

22ac79827f84775e1d7e29d30be9d6db54aa27305473506fb107364fc1a651c2
SHA512

2dcaf3839b4ad859dc0530e052e6215e91f97d21ebf70ec55ad2ccb93680f1ef2a01124e4540b8261218c90255dea8efca03bdfccddef2769b8694e352ba560d
SSDEEP

6144:IHaaOKWwI9deR6VFpxIyEBRrGmp2RZ1cb7lR5XamY10CZLHQpW:IHaIWwMQg7EHrzp7ramYBZzz

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2516 wrote to memory of 2868	2516	regsvr32.exe	30
PID 2516 wrote to memory of 2868	2516	regsvr32.exe	30
PID 2516 wrote to memory of 2868	2516	regsvr32.exe	30
PID 2516 wrote to memory of 2868	2516	regsvr32.exe	30
PID 2516 wrote to memory of 2868	2516	regsvr32.exe	30
PID 2516 wrote to memory of 2868	2516	regsvr32.exe	30
PID 2516 wrote to memory of 2868	2516	regsvr32.exe	30

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\5ed5d18ea4c2cbf9d33e9a96a052a28b_JaffaCakes118.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:2516
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\5ed5d18ea4c2cbf9d33e9a96a052a28b_JaffaCakes118.exe
  2⤵
  PID:2868