eb54f756b120cb1bf47e997c2ac09b1bea716762df209d3514877900d3a208c9

Analysis

max time kernel
120s
max time network
128s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
22/07/2024, 00:40

Target

621681f312c0fc85c1082455cdcd382b_JaffaCakes118.dll
Size

140KB
MD5

621681f312c0fc85c1082455cdcd382b
SHA1

bf7fc3774119ad7763b76a792e61e20a5b57e60a
SHA256

eb54f756b120cb1bf47e997c2ac09b1bea716762df209d3514877900d3a208c9
SHA512

f5cd1b1da29a2c58683c93c6f853768ccf5d2286aad85bf3a7214f0d4db3c788de2f8e4a153ce938146741c85818ab3e8bee45152085387c33a58ba3066fb1e4
SSDEEP

1536:fI7Ym8bz6/zXeGb4HipcH1WK9XIag63RIS2mcs8kBSoJEKvbY6bHC4HHip:gqbiB0CpMnRv+SV8k9EKvbYGHCp

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2368 wrote to memory of 112	2368	regsvr32.exe	29
PID 2368 wrote to memory of 112	2368	regsvr32.exe	29
PID 2368 wrote to memory of 112	2368	regsvr32.exe	29
PID 2368 wrote to memory of 112	2368	regsvr32.exe	29
PID 2368 wrote to memory of 112	2368	regsvr32.exe	29
PID 2368 wrote to memory of 112	2368	regsvr32.exe	29
PID 2368 wrote to memory of 112	2368	regsvr32.exe	29

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\621681f312c0fc85c1082455cdcd382b_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2368
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\621681f312c0fc85c1082455cdcd382b_JaffaCakes118.dll
  2⤵
  PID:112

memory/112-0-0x00000000001B0000-0x00000000001EF000-memory.dmp

Filesize
252KB

Download