f3db0e3cad037bb885b06c17aaf76977d6e91858032e2fb5d5b759421cea4692

Analysis

max time kernel
13s
max time network
19s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
23/07/2024, 07:11

Target

669c9ffb80dda9e055f8060332ca9c75_JaffaCakes118.dll
Size

87KB
MD5

669c9ffb80dda9e055f8060332ca9c75
SHA1

3af34d9cc43083ca00ebbbd7f8cbc94bb6276ca0
SHA256

f3db0e3cad037bb885b06c17aaf76977d6e91858032e2fb5d5b759421cea4692
SHA512

668fc430d7f57848e55c2b1acafd29140431d72353209b832208f2eb9f6088fb4c699ce6f990a9e45a6717e4b30f24e2307a962177293a4d52788c0957c46f6c
SSDEEP

1536:leSHmch8Hh7o4voO9y0NaybOCOFUsz4rbaZo5lXoUn/Bn8xg5iWqUSKPPFJ9ZV5s:LLhStwOnTbODmszUbt//B8xd9279ZjfE

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2452 wrote to memory of 2812	2452	regsvr32.exe	29
PID 2452 wrote to memory of 2812	2452	regsvr32.exe	29
PID 2452 wrote to memory of 2812	2452	regsvr32.exe	29
PID 2452 wrote to memory of 2812	2452	regsvr32.exe	29
PID 2452 wrote to memory of 2812	2452	regsvr32.exe	29
PID 2452 wrote to memory of 2812	2452	regsvr32.exe	29
PID 2452 wrote to memory of 2812	2452	regsvr32.exe	29

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\669c9ffb80dda9e055f8060332ca9c75_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2452
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\669c9ffb80dda9e055f8060332ca9c75_JaffaCakes118.dll
  2⤵
  PID:2812

memory/2812-0-0x0000000000760000-0x00000000007A4000-memory.dmp

Filesize
272KB

Download
memory/2812-1-0x0000000000760000-0x00000000007A4000-memory.dmp

Filesize
272KB

Download