a3fe62d7f9decdb32d0e90218d00e60915bbc4acc361bfde3b6ef26e2890f70f

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
21/07/2024, 20:22

Target

61435a38683d23fe0186435e20835860_JaffaCakes118.dll
Size

32KB
MD5

61435a38683d23fe0186435e20835860
SHA1

40a362d0b69509a9a63afccf2d9321aef4b881ec
SHA256

a3fe62d7f9decdb32d0e90218d00e60915bbc4acc361bfde3b6ef26e2890f70f
SHA512

d6038fe3551b939ef7f8a91060af3a79993d2ef932b2a3c659d662dcc4ecb2b7c1a3cd8e034c235ef4770b0326d41ef69a9d2b0ca5275e9ceb13d43bf90d0a4c
SSDEEP

768:97+SACC8pEmtqwkEKYF3w3RGSE4rtdKrwq1:J+SACNkDq4RGSE4/M1

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2876 wrote to memory of 2944	2876	regsvr32.exe	30
PID 2876 wrote to memory of 2944	2876	regsvr32.exe	30
PID 2876 wrote to memory of 2944	2876	regsvr32.exe	30
PID 2876 wrote to memory of 2944	2876	regsvr32.exe	30
PID 2876 wrote to memory of 2944	2876	regsvr32.exe	30
PID 2876 wrote to memory of 2944	2876	regsvr32.exe	30
PID 2876 wrote to memory of 2944	2876	regsvr32.exe	30

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\61435a38683d23fe0186435e20835860_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2876
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\61435a38683d23fe0186435e20835860_JaffaCakes118.dll
  2⤵
  PID:2944