15a9c386521b7ea063f0bde08c4c8e310f4d9a0565f6bd791cf2c18025d8aa6b

Analysis

max time kernel
13s
max time network
19s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
22/07/2024, 14:20

Target

6383bd63ddb87d5dcb86f9675a625b22_JaffaCakes118.dll
Size

167KB
MD5

6383bd63ddb87d5dcb86f9675a625b22
SHA1

730bffe176fa5d1175f218971534110487d4a98c
SHA256

15a9c386521b7ea063f0bde08c4c8e310f4d9a0565f6bd791cf2c18025d8aa6b
SHA512

38c3daf9721c7fa2967af0d1eb781951701a6883d484d5ac2ab6d1367593980c0a4f9572b3c18265a659bc80f74fb0173de0e17b03fa321134ad39070da62a75
SSDEEP

1536:td8CHyODFIjHIN7zQmuFXAdmmdyunZxYN3DrtY1B4xx3k98b0DuLco:rLHy067IN7zQmuB7Punoqbj9RDuLj

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1272 wrote to memory of 1828	1272	regsvr32.exe	29
PID 1272 wrote to memory of 1828	1272	regsvr32.exe	29
PID 1272 wrote to memory of 1828	1272	regsvr32.exe	29
PID 1272 wrote to memory of 1828	1272	regsvr32.exe	29
PID 1272 wrote to memory of 1828	1272	regsvr32.exe	29
PID 1272 wrote to memory of 1828	1272	regsvr32.exe	29
PID 1272 wrote to memory of 1828	1272	regsvr32.exe	29

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\6383bd63ddb87d5dcb86f9675a625b22_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1272
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\6383bd63ddb87d5dcb86f9675a625b22_JaffaCakes118.dll
  2⤵
  PID:1828

memory/1828-0-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download