c317d49422c85491f69dbe6019f224e49abd4d9eb8f5eaea2c9c2e53e080c866

Analysis

max time kernel
9s
max time network
17s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
22/07/2024, 22:40

Target

6515402d7f169c1b52055a8ad6264b79_JaffaCakes118.dll
Size

53KB
MD5

6515402d7f169c1b52055a8ad6264b79
SHA1

01081733257637d04b6b5d580c71ebb09749354a
SHA256

c317d49422c85491f69dbe6019f224e49abd4d9eb8f5eaea2c9c2e53e080c866
SHA512

93f79bde46c6eae529b6e970807cbe49873256328b6a23cbaa31b85fb185434e8b28fb3309e3009a945651eacb4a8751b61827f911200acbc38451f3ffd1b35c
SSDEEP

1536:XvxEYx47v6mKR2wRcAcL3yLE2XFwdEfzPXfhX5/FPP0kWq:/x/x4r6mKf+dD2X+6frPhPckW

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2544 wrote to memory of 676	2544	regsvr32.exe	30
PID 2544 wrote to memory of 676	2544	regsvr32.exe	30
PID 2544 wrote to memory of 676	2544	regsvr32.exe	30
PID 2544 wrote to memory of 676	2544	regsvr32.exe	30
PID 2544 wrote to memory of 676	2544	regsvr32.exe	30
PID 2544 wrote to memory of 676	2544	regsvr32.exe	30
PID 2544 wrote to memory of 676	2544	regsvr32.exe	30

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\6515402d7f169c1b52055a8ad6264b79_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2544
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\6515402d7f169c1b52055a8ad6264b79_JaffaCakes118.dll
  2⤵
  PID:676

memory/676-0-0x00000000001B0000-0x00000000001E1000-memory.dmp

Filesize
196KB

Download