5ef353e439dbf47b6cea65fb54e97c5bae49b1e8800bb3dae365270520d215a3

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
21/07/2024, 13:33

Target

60ab94cdcb872632ce20f0a60f2d96f6_JaffaCakes118.dll
Size

40KB
MD5

60ab94cdcb872632ce20f0a60f2d96f6
SHA1

034a5962ac65e35ca4090bff7a47b3a80fd1cccd
SHA256

5ef353e439dbf47b6cea65fb54e97c5bae49b1e8800bb3dae365270520d215a3
SHA512

8990fefd561baa47bf1dc63a916e0222ac4c7bc85515c0397540ef406e3dac05cf4473f832f012cefcb48a3db719ec811ed0493f73b93be92ca82982fe15d3cb
SSDEEP

768:jBsdD5cLCLHoQFmFMK2XUymw2nrpkavDWgLa16XW/h:xuDo6M5Zym8QzLabJ

Score

1^/10

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2368	Rundll32.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2368	Rundll32.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2624 wrote to memory of 2820	2624	regsvr32.exe	30
PID 2624 wrote to memory of 2820	2624	regsvr32.exe	30
PID 2624 wrote to memory of 2820	2624	regsvr32.exe	30
PID 2624 wrote to memory of 2820	2624	regsvr32.exe	30
PID 2624 wrote to memory of 2820	2624	regsvr32.exe	30
PID 2624 wrote to memory of 2820	2624	regsvr32.exe	30
PID 2624 wrote to memory of 2820	2624	regsvr32.exe	30
PID 2820 wrote to memory of 2368	2820	regsvr32.exe	31
PID 2820 wrote to memory of 2368	2820	regsvr32.exe	31
PID 2820 wrote to memory of 2368	2820	regsvr32.exe	31
PID 2820 wrote to memory of 2368	2820	regsvr32.exe	31
PID 2820 wrote to memory of 2368	2820	regsvr32.exe	31
PID 2820 wrote to memory of 2368	2820	regsvr32.exe	31
PID 2820 wrote to memory of 2368	2820	regsvr32.exe	31

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\60ab94cdcb872632ce20f0a60f2d96f6_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2624
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\60ab94cdcb872632ce20f0a60f2d96f6_JaffaCakes118.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2820
- - C:\Windows\SysWOW64\Rundll32.exe
    C:\Windows\system32\Rundll32.exe C:\Users\Admin\AppData\Local\Temp\60ab94cdcb872632ce20f0a60f2d96f6_JaffaCakes118.dll,DllUnregisterServer
    3⤵
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    PID:2368