2e505c4baa8b29009c562dd01543740be0788872a1d80be80e49b10577bd05ec

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
21/07/2024, 12:40

Target

6098ff000b2a54516e9c61fe98b0cf90_JaffaCakes118.dll
Size

256KB
MD5

6098ff000b2a54516e9c61fe98b0cf90
SHA1

fbdcbb500eb77dc89183fad243c658c7a608dd7f
SHA256

2e505c4baa8b29009c562dd01543740be0788872a1d80be80e49b10577bd05ec
SHA512

5ef244cd26b8a3ce9a76ee22d03e3a4fdb4885e6a353c9aff86c002f45c4057c59e56b334339febdc6cf3a77a7c6d593365c74cd3f7e19a81e4af6a9d4f0ccd8
SSDEEP

3072:Dvji2kRPhQskqgo3tD5/PWd7yto2NR55JcgnXPEnGwR+Zvzon1P6m:DnkVhV1NRPWwvNUz

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3024 wrote to memory of 3044	3024	regsvr32.exe	30
PID 3024 wrote to memory of 3044	3024	regsvr32.exe	30
PID 3024 wrote to memory of 3044	3024	regsvr32.exe	30
PID 3024 wrote to memory of 3044	3024	regsvr32.exe	30
PID 3024 wrote to memory of 3044	3024	regsvr32.exe	30
PID 3024 wrote to memory of 3044	3024	regsvr32.exe	30
PID 3024 wrote to memory of 3044	3024	regsvr32.exe	30

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\6098ff000b2a54516e9c61fe98b0cf90_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3024
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\6098ff000b2a54516e9c61fe98b0cf90_JaffaCakes118.dll
  2⤵
  PID:3044

memory/3044-0-0x0000000010000000-0x0000000010040000-memory.dmp

Filesize
256KB

Download