ace8b9084c69d761fc4d0e9bd5b53b69a274d3e25a3c0ebdff438a25a78c40d9

Analysis

max time kernel
122s
max time network
130s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
23-07-2024 00:53

Target

658048231aca5ec436e3a1f58c5934f8_JaffaCakes118.dll
Size

21KB
MD5

658048231aca5ec436e3a1f58c5934f8
SHA1

ca29b12e00e65bc1322025520f79f6fe48cf7994
SHA256

ace8b9084c69d761fc4d0e9bd5b53b69a274d3e25a3c0ebdff438a25a78c40d9
SHA512

296ad5420b65333a2d50fc3e47ad2b82bd3cfb683fc4917e93d569ba1b9ce8b77d769e844bc7ab29073fd08102d4f7b3f2a1cd4d857fa063356f0812c034715a
SSDEEP

384:e5Bnb2vDPEkrbXDcZo9EmpPNbnKNvGdfPEShuuDKqYoF0Ay+8fOEmO4zGKhtLyy:Wb2LGomm1N0vGFPFhQoCt1mO4LhtP

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2280 wrote to memory of 236	2280	regsvr32.exe	31
PID 2280 wrote to memory of 236	2280	regsvr32.exe	31
PID 2280 wrote to memory of 236	2280	regsvr32.exe	31
PID 2280 wrote to memory of 236	2280	regsvr32.exe	31
PID 2280 wrote to memory of 236	2280	regsvr32.exe	31
PID 2280 wrote to memory of 236	2280	regsvr32.exe	31
PID 2280 wrote to memory of 236	2280	regsvr32.exe	31

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\658048231aca5ec436e3a1f58c5934f8_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2280
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\658048231aca5ec436e3a1f58c5934f8_JaffaCakes118.dll
  2⤵
  PID:236

memory/236-1-0x00000000000C0000-0x00000000000D7000-memory.dmp

Filesize
92KB

Download
memory/236-0-0x00000000000C0000-0x00000000000D7000-memory.dmp

Filesize
92KB

Download