64558dde22c3185d91935de76a722188e6ca946a3399f383adff3ca070b19a14

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
23/07/2024, 11:49

Target

67793f315c004f75bad21b065b0ae2bc_JaffaCakes118.dll
Size

79KB
MD5

67793f315c004f75bad21b065b0ae2bc
SHA1

d0b43b6073fcd2410e280f160ed24408f153af35
SHA256

64558dde22c3185d91935de76a722188e6ca946a3399f383adff3ca070b19a14
SHA512

7cf4cb33770d2179dda76aaf40290c5d67c0336335f882ccebb1f6128d4d9c7a0981179f1306216edf9a88a7d2d4b895db1da9631587d8bb68eecd00db5b8eba
SSDEEP

1536:tUicvdi8LUVeNBPWHGiUWpAvYJUR2bNHC60rr:tDudkwvBWWYJi2Ri60X

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2652 wrote to memory of 2228	2652	regsvr32.exe	30
PID 2652 wrote to memory of 2228	2652	regsvr32.exe	30
PID 2652 wrote to memory of 2228	2652	regsvr32.exe	30
PID 2652 wrote to memory of 2228	2652	regsvr32.exe	30
PID 2652 wrote to memory of 2228	2652	regsvr32.exe	30
PID 2652 wrote to memory of 2228	2652	regsvr32.exe	30
PID 2652 wrote to memory of 2228	2652	regsvr32.exe	30

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\67793f315c004f75bad21b065b0ae2bc_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2652
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\67793f315c004f75bad21b065b0ae2bc_JaffaCakes118.dll
  2⤵
  PID:2228