3e419819d4c50e96a8766d89d264ab734d9fb1a8b4e8799696c27c9f4d57a610

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15/04/2024, 05:41

Target

f070f006f48ca8909ace9745ea1b4a57_JaffaCakes118.dll
Size

5KB
MD5

f070f006f48ca8909ace9745ea1b4a57
SHA1

85ba4abb04cf9951ad07861efeb16ef317de4c39
SHA256

3e419819d4c50e96a8766d89d264ab734d9fb1a8b4e8799696c27c9f4d57a610
SHA512

b5824219c0929d7ae5f31671ddb06f581dfa22c1a5d3f3b75bdacd8d743c595dc9e100bce6eeafb31ea1c817a1427b645fa59dda22a104e961e94d422e2e4df7
SSDEEP

48:q1mxrY0ydXlqIVapTfNc9CihbbbLsvTgVc/nPRogM/:nWd5VaJVcv/bLoPeP/

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2164 wrote to memory of 2100	2164	rundll32.exe	28
PID 2164 wrote to memory of 2100	2164	rundll32.exe	28
PID 2164 wrote to memory of 2100	2164	rundll32.exe	28
PID 2164 wrote to memory of 2100	2164	rundll32.exe	28
PID 2164 wrote to memory of 2100	2164	rundll32.exe	28
PID 2164 wrote to memory of 2100	2164	rundll32.exe	28
PID 2164 wrote to memory of 2100	2164	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f070f006f48ca8909ace9745ea1b4a57_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2164
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f070f006f48ca8909ace9745ea1b4a57_JaffaCakes118.dll,#1
  2⤵
  PID:2100

memory/2100-0-0x0000000040960000-0x0000000040971000-memory.dmp

Filesize
68KB

Download