c7269ac42592c52c88d84cafef40f8ec20d7c7fa462927d9753ee49140c72714

Analysis

max time kernel
14s
max time network
19s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
22-07-2024 15:39

Target

63c588e3503dd91f4d3106ac198503e9_JaffaCakes118.dll
Size

109KB
MD5

63c588e3503dd91f4d3106ac198503e9
SHA1

47446b50198d1d947544c0c6c3a25ee7582ced9a
SHA256

c7269ac42592c52c88d84cafef40f8ec20d7c7fa462927d9753ee49140c72714
SHA512

c1b9daa7d7689216afe02305ba6faba18c256bf64d612946700ea0f5b989f0a9d3529590b6a0edecf0a751e62343da7a5967b29c171a2c81f11b419396eac8e4
SSDEEP

3072:FwYGYXGUEZXc9ZxZR3krIZ7O/raF0r5hWzF:F52UENc1z4rad

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2276 wrote to memory of 1052	2276	regsvr32.exe	30
PID 2276 wrote to memory of 1052	2276	regsvr32.exe	30
PID 2276 wrote to memory of 1052	2276	regsvr32.exe	30
PID 2276 wrote to memory of 1052	2276	regsvr32.exe	30
PID 2276 wrote to memory of 1052	2276	regsvr32.exe	30
PID 2276 wrote to memory of 1052	2276	regsvr32.exe	30
PID 2276 wrote to memory of 1052	2276	regsvr32.exe	30

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\63c588e3503dd91f4d3106ac198503e9_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2276
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\63c588e3503dd91f4d3106ac198503e9_JaffaCakes118.dll
  2⤵
  PID:1052

memory/1052-0-0x0000000067000000-0x0000000067024000-memory.dmp

Filesize
144KB

Download