5957db0a97323d803f946fc589e3daf256530f885d5ee4e89267a178b004c607

Analysis

max time kernel
122s
max time network
122s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
10/04/2024, 23:17

Target

ec33960bfa07cc2d02c5026799260b63_JaffaCakes118.dll
Size

41KB
MD5

ec33960bfa07cc2d02c5026799260b63
SHA1

05a88bd273ac33b482a06a6e30c1b26e574adf43
SHA256

5957db0a97323d803f946fc589e3daf256530f885d5ee4e89267a178b004c607
SHA512

6d52d4006c1e6f2e72a1119809d1c27b0fe574c9e232a279b01ea9f341bdf61003213307b7bcfe3c4777cd91adfc8cbb75e65f751101ed2ba1c6fc55f616f5d1
SSDEEP

768:GbvLDaaMact8TpC3ecG3LZqT03bGTFZBj71k0lNVGKAR2P0z:evtC3ecG3LZqIGxfSrfz

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2220 wrote to memory of 2720	2220	rundll32.exe	28
PID 2220 wrote to memory of 2720	2220	rundll32.exe	28
PID 2220 wrote to memory of 2720	2220	rundll32.exe	28
PID 2220 wrote to memory of 2720	2220	rundll32.exe	28
PID 2220 wrote to memory of 2720	2220	rundll32.exe	28
PID 2220 wrote to memory of 2720	2220	rundll32.exe	28
PID 2220 wrote to memory of 2720	2220	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ec33960bfa07cc2d02c5026799260b63_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2220
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ec33960bfa07cc2d02c5026799260b63_JaffaCakes118.dll,#1
  2⤵
  PID:2720

memory/2720-0-0x0000000010000000-0x000000001000C000-memory.dmp

Filesize
48KB

Download
memory/2720-1-0x0000000010000000-0x000000001000C000-memory.dmp

Filesize
48KB

Download