b2b51a1c6f87428b0269f8615fb336fd97ed71fb8320328a042396b39bfc8430

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 00:44

Target

692f06ceced57fbf22f6dd0a96fc37f8_JaffaCakes118.dll
Size

2.5MB
MD5

692f06ceced57fbf22f6dd0a96fc37f8
SHA1

74ee998d15fc5cc21b91f06402c6b05cacbd2185
SHA256

b2b51a1c6f87428b0269f8615fb336fd97ed71fb8320328a042396b39bfc8430
SHA512

5fd6a31a1e10594b421096cb6ae3dce5c9680b8292b1231c31ac85f2fe34fb48757701724d0a5c028f762e53d1fe1b14fee326787eaf488252d606cdc23fa020
SSDEEP

49152:6mrH52YGuaiucb2sdcdk3YZ/8/RRLMSaYzRFx1UvoOFMXYsejb:frHWuaiucb2sadHZ/8/PYYzRH1UvoOFP

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3012 wrote to memory of 3040	3012	rundll32.exe	rundll32.exe
PID 3012 wrote to memory of 3040	3012	rundll32.exe	rundll32.exe
PID 3012 wrote to memory of 3040	3012	rundll32.exe	rundll32.exe
PID 3012 wrote to memory of 3040	3012	rundll32.exe	rundll32.exe
PID 3012 wrote to memory of 3040	3012	rundll32.exe	rundll32.exe
PID 3012 wrote to memory of 3040	3012	rundll32.exe	rundll32.exe
PID 3012 wrote to memory of 3040	3012	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\692f06ceced57fbf22f6dd0a96fc37f8_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3012

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\692f06ceced57fbf22f6dd0a96fc37f8_JaffaCakes118.dll,#1
2⤵
PID:3040

memory/3040-0-0x00000000745E0000-0x00000000747B2000-memory.dmp

Filesize
1.8MB

Download
memory/3040-1-0x0000000074400000-0x00000000745D2000-memory.dmp

Filesize
1.8MB

Download
memory/3040-2-0x00000000745E0000-0x00000000747B2000-memory.dmp

Filesize
1.8MB

Download