9472e01e95b798cc0ae2769e64d0489670b56406c9a7f4b3a68a37f1c0fdf477

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
09/04/2024, 00:31

Target

e8cb5b744d9a6e5ee781005e92c4ba69_JaffaCakes118.dll
Size

2.1MB
MD5

e8cb5b744d9a6e5ee781005e92c4ba69
SHA1

f21b081b7df1f1b882410533130514e81e406c00
SHA256

9472e01e95b798cc0ae2769e64d0489670b56406c9a7f4b3a68a37f1c0fdf477
SHA512

0697d4900c968b13484271905bf66dac99afc69f61875f36396c03906939ae3eaf8ab637e3917bfee2c2f9471ca6da41157e638c5b89f7db15910980c3715d7a
SSDEEP

49152:VVk6y3tQu2XG8ZoI9Z9rqyI44HppuzGxHHY4L2q5q:V26y3SWGoqZ92yVG/uzGNV9q

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1728 wrote to memory of 1880	1728	rundll32.exe	28
PID 1728 wrote to memory of 1880	1728	rundll32.exe	28
PID 1728 wrote to memory of 1880	1728	rundll32.exe	28
PID 1728 wrote to memory of 1880	1728	rundll32.exe	28
PID 1728 wrote to memory of 1880	1728	rundll32.exe	28
PID 1728 wrote to memory of 1880	1728	rundll32.exe	28
PID 1728 wrote to memory of 1880	1728	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e8cb5b744d9a6e5ee781005e92c4ba69_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1728
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\e8cb5b744d9a6e5ee781005e92c4ba69_JaffaCakes118.dll,#1
  2⤵
  PID:1880

memory/1880-0-0x0000000010000000-0x0000000010007000-memory.dmp

Filesize
28KB

Download