41177bceb48dac153d307fa74207f4d872d3f0159876d4bea975f72faa177e9f

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
09/05/2024, 06:52

Target

28cd1dcbe5a0853068bc536363b97526_JaffaCakes118.dll
Size

2.7MB
MD5

28cd1dcbe5a0853068bc536363b97526
SHA1

9eec729d5d3f303b263e66f01994e86614f61b18
SHA256

41177bceb48dac153d307fa74207f4d872d3f0159876d4bea975f72faa177e9f
SHA512

6ec9d268ad4ed82c314b9002a1986bf25ddaac1a970ae971c104f87488be6c9ca89bde9226118b63e250e2d78b9854e2a8d205dd4aa979b9b9444d05a789a468
SSDEEP

49152:0Ro8CFtK3oTK4GLctsc9vcNvMs+nurHR8S2z16eHvBpN0WTK753BlxGDMegGcX7d:UHCFt7TqZwvcaIrHR8SC6eDDMegGch

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2432 wrote to memory of 2012	2432	rundll32.exe	28
PID 2432 wrote to memory of 2012	2432	rundll32.exe	28
PID 2432 wrote to memory of 2012	2432	rundll32.exe	28
PID 2432 wrote to memory of 2012	2432	rundll32.exe	28
PID 2432 wrote to memory of 2012	2432	rundll32.exe	28
PID 2432 wrote to memory of 2012	2432	rundll32.exe	28
PID 2432 wrote to memory of 2012	2432	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\28cd1dcbe5a0853068bc536363b97526_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2432
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\28cd1dcbe5a0853068bc536363b97526_JaffaCakes118.dll,#1
  2⤵
  PID:2012

memory/2012-0-0x0000000010000000-0x00000000102B5000-memory.dmp

Filesize
2.7MB

Download