9c2991620db3d433e1f0d493e33f5e0378dfe346bc2a5aaa9175228a8703c8b5

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
19-04-2024 20:11

Target

fb1509a188e327db3d2b0a57ab2c9bd0_JaffaCakes118.dll
Size

84KB
MD5

fb1509a188e327db3d2b0a57ab2c9bd0
SHA1

97aa2aba96c64e2ffba5e33559aa1c0bd79c1564
SHA256

9c2991620db3d433e1f0d493e33f5e0378dfe346bc2a5aaa9175228a8703c8b5
SHA512

6a5bdf35e87303a21339e6f282c7a5d5ba22b75f484683bf7fd394a743890442f0f328e3978704d453f8103cd0ba38c1fa2e238c7e61a4a3061ae09edeeacc61
SSDEEP

1536:G+NPi9z0loXmhhYW+kIKdPmiL8ZAXqvhCKHi5+QiKprz:G+NKuoWh6WzISNL8ZZpe6uz

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2208 wrote to memory of 1752	2208	rundll32.exe	28
PID 2208 wrote to memory of 1752	2208	rundll32.exe	28
PID 2208 wrote to memory of 1752	2208	rundll32.exe	28
PID 2208 wrote to memory of 1752	2208	rundll32.exe	28
PID 2208 wrote to memory of 1752	2208	rundll32.exe	28
PID 2208 wrote to memory of 1752	2208	rundll32.exe	28
PID 2208 wrote to memory of 1752	2208	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fb1509a188e327db3d2b0a57ab2c9bd0_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2208
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\fb1509a188e327db3d2b0a57ab2c9bd0_JaffaCakes118.dll,#1
  2⤵
  PID:1752

memory/1752-0-0x00000000008E0000-0x00000000009C7000-memory.dmp

Filesize
924KB

Download