567e123cc7c2b8781127ad5e512640db34b1005286e1ecfb2eb6a31fbe265a2d

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
21/07/2024, 18:46

Target

61016bece947046c78fa225d9189499e_JaffaCakes118.dll
Size

238KB
MD5

61016bece947046c78fa225d9189499e
SHA1

b8b287151245448ec39d2db40935afdbfbdedb95
SHA256

567e123cc7c2b8781127ad5e512640db34b1005286e1ecfb2eb6a31fbe265a2d
SHA512

dc1ca9959bc2d10c38d367b5b928656536734641b7801b843eec71677eb04a60a10c049e29a90510c6f7e2a31dc55c5fca80387b6d5da01e0e11529b90f4fd03
SSDEEP

3072:s2HvXXx3fcw3G0YHp+AgmpLIQlU/lR/ySQTcMZ3i8w7+0FLX:3PxPr3oIQlKRWcL7+0FLX

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2604 wrote to memory of 2456	2604	regsvr32.exe	31
PID 2604 wrote to memory of 2456	2604	regsvr32.exe	31
PID 2604 wrote to memory of 2456	2604	regsvr32.exe	31
PID 2604 wrote to memory of 2456	2604	regsvr32.exe	31
PID 2604 wrote to memory of 2456	2604	regsvr32.exe	31
PID 2604 wrote to memory of 2456	2604	regsvr32.exe	31
PID 2604 wrote to memory of 2456	2604	regsvr32.exe	31

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\61016bece947046c78fa225d9189499e_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2604
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\61016bece947046c78fa225d9189499e_JaffaCakes118.dll
  2⤵
  PID:2456