9c2cc47ff43ed69ab09232608c0bd878d8e60f634ce47d8b3bbd05d0bd1fab46

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
21/04/2024, 11:14

Target

ff27a046a307b5aeeb614b665faaf9f5_JaffaCakes118.dll
Size

18KB
MD5

ff27a046a307b5aeeb614b665faaf9f5
SHA1

d1502f4d852fdf74c7b8f11d7980c5c9cddcd57d
SHA256

9c2cc47ff43ed69ab09232608c0bd878d8e60f634ce47d8b3bbd05d0bd1fab46
SHA512

0dfef35dd684f2e0227147a892c544e093dd556e2a9c5d36a650e217b5b41e0d77b8807cb82c120ece0bb53dc01759973498146afde69271e9eebd6484d9c8a0
SSDEEP

192:FM5M5Qy/f4KJ5LxRN+9qwN5RU4PgCg3leYzTxpo38IoCfE7:iolJ5LHNaXU0cVeY/xpo38IffE7

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1664 wrote to memory of 2940	1664	rundll32.exe	28
PID 1664 wrote to memory of 2940	1664	rundll32.exe	28
PID 1664 wrote to memory of 2940	1664	rundll32.exe	28
PID 1664 wrote to memory of 2940	1664	rundll32.exe	28
PID 1664 wrote to memory of 2940	1664	rundll32.exe	28
PID 1664 wrote to memory of 2940	1664	rundll32.exe	28
PID 1664 wrote to memory of 2940	1664	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ff27a046a307b5aeeb614b665faaf9f5_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1664
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ff27a046a307b5aeeb614b665faaf9f5_JaffaCakes118.dll,#1
  2⤵
  PID:2940

memory/2940-0-0x000000006F9C0000-0x000000006F9C7000-memory.dmp

Filesize
28KB

Download