90e0ab369a18598fec297d5c89e55165d2cec48d1aa16facd8beb3c62ac7006b

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
20/07/2024, 07:49

Target

5fa1dea5ac6b0c4071629f7efdf5748a_JaffaCakes118.dll
Size

88KB
MD5

5fa1dea5ac6b0c4071629f7efdf5748a
SHA1

225787e5821301fb3f33f83af0e64e8362d164ce
SHA256

90e0ab369a18598fec297d5c89e55165d2cec48d1aa16facd8beb3c62ac7006b
SHA512

f36e4925fa63e2813b859ec549c543c321f2ec50ae7a155217ba2cf037e74b9abc5dbb6a561672a1a24dad332f0a3364ce117c03e6039552ba3eb1e412c40377
SSDEEP

1536:y9+8yxz2xm8Do9oJe9/QTxJHWy9zLSM9bTmtZ+zgdvfomF8dBVT/IxJVcsxJS:ygxz6To9Ue9oTr1ZLSMJTmtXVQtdBl/X

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2124 wrote to memory of 2200	2124	regsvr32.exe	30
PID 2124 wrote to memory of 2200	2124	regsvr32.exe	30
PID 2124 wrote to memory of 2200	2124	regsvr32.exe	30
PID 2124 wrote to memory of 2200	2124	regsvr32.exe	30
PID 2124 wrote to memory of 2200	2124	regsvr32.exe	30
PID 2124 wrote to memory of 2200	2124	regsvr32.exe	30
PID 2124 wrote to memory of 2200	2124	regsvr32.exe	30

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\5fa1dea5ac6b0c4071629f7efdf5748a_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2124
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\5fa1dea5ac6b0c4071629f7efdf5748a_JaffaCakes118.dll
  2⤵
  PID:2200

memory/2200-0-0x0000000000140000-0x0000000000183000-memory.dmp

Filesize
268KB

Download