08e572a87c7813efbef25e9f9a324eab9b81c1df2eae68c7140ddfe55cd88e53

Analysis

max time kernel
122s
max time network
124s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
23/07/2024, 13:37

Target

67ca12aded9c52cb0b082115a56cacb7_JaffaCakes118.dll
Size

628KB
MD5

67ca12aded9c52cb0b082115a56cacb7
SHA1

227bc17efa54edada9f4d102c18b6383c2145d9d
SHA256

08e572a87c7813efbef25e9f9a324eab9b81c1df2eae68c7140ddfe55cd88e53
SHA512

9c24b1ec8c4fab0233042cbc0402b85e34a321e332611497c1bf7f12f26ae7bfbd361137e091ff86b51ca548ff0262094f62a71044e964c2cc6554e92ead52a2
SSDEEP

12288:aXN+j2hor0tDRNtIuH0of9WTUKsbqbGkMME23:aXXhc0t17IuH0ofSUKsbIM323

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2660 wrote to memory of 2628	2660	regsvr32.exe	30
PID 2660 wrote to memory of 2628	2660	regsvr32.exe	30
PID 2660 wrote to memory of 2628	2660	regsvr32.exe	30
PID 2660 wrote to memory of 2628	2660	regsvr32.exe	30
PID 2660 wrote to memory of 2628	2660	regsvr32.exe	30
PID 2660 wrote to memory of 2628	2660	regsvr32.exe	30
PID 2660 wrote to memory of 2628	2660	regsvr32.exe	30

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\67ca12aded9c52cb0b082115a56cacb7_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2660
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\67ca12aded9c52cb0b082115a56cacb7_JaffaCakes118.dll
  2⤵
  PID:2628

memory/2628-0-0x0000000074B70000-0x0000000074C0F000-memory.dmp

Filesize
636KB

Download