d8e0176f870e679c4b296a7b5dae49921a460b59d3b3e261e76b61f2d88620d5

Analysis

max time kernel
120s
max time network
122s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
22-07-2024 17:35

Target

64204614037aa0378976491789618400_JaffaCakes118.dll
Size

220KB
MD5

64204614037aa0378976491789618400
SHA1

86a0365704921d0a944f76b2bd5ef000e27056db
SHA256

d8e0176f870e679c4b296a7b5dae49921a460b59d3b3e261e76b61f2d88620d5
SHA512

76c35a061d1801e43f02caa5b5df7b09cf097fef32e07e2b9fa8ae4bc9c99bd276045fee7bba98e51cf30b4fcf92394bb5cf007ad8e065c7511ece191e6e65fe
SSDEEP

1536:pkfZ+l7oGWnM6zkfZ+l7oGWnM6zkfZ+l7oGWnM6zkfZ+l7oGWnM6zkfZ+l7oGWnD:qGW/EGW/EGW/EGW/EGW/EGW/EGW/

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 656 wrote to memory of 2308	656	regsvr32.exe	29
PID 656 wrote to memory of 2308	656	regsvr32.exe	29
PID 656 wrote to memory of 2308	656	regsvr32.exe	29
PID 656 wrote to memory of 2308	656	regsvr32.exe	29
PID 656 wrote to memory of 2308	656	regsvr32.exe	29
PID 656 wrote to memory of 2308	656	regsvr32.exe	29
PID 656 wrote to memory of 2308	656	regsvr32.exe	29

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\64204614037aa0378976491789618400_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:656
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\64204614037aa0378976491789618400_JaffaCakes118.dll
  2⤵
  PID:2308

memory/2308-0-0x0000000000170000-0x000000000017D000-memory.dmp

Filesize
52KB

Download