b2f9cc14b87a2180345f52a061e64cfc08930cac72ccf788ce795c282264583f

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
11/04/2024, 10:11

Target

ed2c9134219e6b6bb2000a042077012f_JaffaCakes118.dll
Size

185KB
MD5

ed2c9134219e6b6bb2000a042077012f
SHA1

c0777989c979aa6475640603c99a979019f79ba5
SHA256

b2f9cc14b87a2180345f52a061e64cfc08930cac72ccf788ce795c282264583f
SHA512

0166a50b3ff2ab10d06d2313aa404f828266712e83b69ebe2a19ff2cfebb174b1f6896b43e4790b039ec55451836826815627ec183d03c1b583eaa238a92633e
SSDEEP

3072:/xqiXUiyZUJT0OyO7TM6Whv9VMXT3YrCCiDLDRaeVarigDWZ1pP85KgAoutN:/xhkj+JT0x6ivHMj35PRRwrPWZ1pPPgc

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2924 wrote to memory of 2944	2924	rundll32.exe	28
PID 2924 wrote to memory of 2944	2924	rundll32.exe	28
PID 2924 wrote to memory of 2944	2924	rundll32.exe	28
PID 2924 wrote to memory of 2944	2924	rundll32.exe	28
PID 2924 wrote to memory of 2944	2924	rundll32.exe	28
PID 2924 wrote to memory of 2944	2924	rundll32.exe	28
PID 2924 wrote to memory of 2944	2924	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ed2c9134219e6b6bb2000a042077012f_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2924
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ed2c9134219e6b6bb2000a042077012f_JaffaCakes118.dll,#1
  2⤵
  PID:2944

memory/2944-0-0x0000000000170000-0x00000000001C5000-memory.dmp

Filesize
340KB

Download
memory/2944-1-0x0000000000170000-0x00000000001C5000-memory.dmp

Filesize
340KB

Download