33ea65b2f2fa5d58b0f326b70f681e912a19176752b264fe2f416f90ea861708

Analysis

max time kernel
119s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
09-04-2024 09:54

Target

e9ba2907922a185afd31216064c9116c_JaffaCakes118.dll
Size

65KB
MD5

e9ba2907922a185afd31216064c9116c
SHA1

79e7a02430fe1a66263f3e853bcecc91e5b02083
SHA256

33ea65b2f2fa5d58b0f326b70f681e912a19176752b264fe2f416f90ea861708
SHA512

c6c3b90b6c69d96e8b2d330cf67440a9a75a18639da6c3cd200b26c71d8ea2ed5a5ff4c35346db5ff9f6387a5570748d8b2bcd7760f4e6bea3ddd17f7d1c0643
SSDEEP

768:q/C3oU4k4tyAxTZshTcLCMcm3WnR+MQdlFwgrgGHycb/36dM+8q65Oev/0:t334gAxTCTckm3WnRqbFDNHlSdloOI/

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2804 wrote to memory of 1056	2804	rundll32.exe	28
PID 2804 wrote to memory of 1056	2804	rundll32.exe	28
PID 2804 wrote to memory of 1056	2804	rundll32.exe	28
PID 2804 wrote to memory of 1056	2804	rundll32.exe	28
PID 2804 wrote to memory of 1056	2804	rundll32.exe	28
PID 2804 wrote to memory of 1056	2804	rundll32.exe	28
PID 2804 wrote to memory of 1056	2804	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e9ba2907922a185afd31216064c9116c_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2804
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\e9ba2907922a185afd31216064c9116c_JaffaCakes118.dll,#1
  2⤵
  PID:1056

memory/1056-0-0x0000000010000000-0x0000000010016000-memory.dmp

Filesize
88KB

Download
memory/1056-1-0x0000000040960000-0x0000000040971000-memory.dmp

Filesize
68KB

Download