0b1178535f3ab44eef83fe698be8590cfad5b132bff92ee779254998b1f4ac09

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
27-05-2024 10:07

Target

78c9d037b3bb874cc6d076f121ea811f_JaffaCakes118.dll
Size

86KB
MD5

78c9d037b3bb874cc6d076f121ea811f
SHA1

72ecee2271b3ab6f63d1b7ba7db140cbe84ca564
SHA256

0b1178535f3ab44eef83fe698be8590cfad5b132bff92ee779254998b1f4ac09
SHA512

453c312a9a638b4fb48596ef43210e58d84e77b7b7a349af2995d8776fe9093a19a8926bcd8ec2087080a0951549a03645d4ba599370a00f3d759de2ec6a3577
SSDEEP

1536:AdvL5ONJfEbrYAQO+htsMSc9QUCS8gD10su0iX/+0+:AdvlgfEAOSte7Sk04W0+

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2416 wrote to memory of 1956	2416	rundll32.exe	28
PID 2416 wrote to memory of 1956	2416	rundll32.exe	28
PID 2416 wrote to memory of 1956	2416	rundll32.exe	28
PID 2416 wrote to memory of 1956	2416	rundll32.exe	28
PID 2416 wrote to memory of 1956	2416	rundll32.exe	28
PID 2416 wrote to memory of 1956	2416	rundll32.exe	28
PID 2416 wrote to memory of 1956	2416	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\78c9d037b3bb874cc6d076f121ea811f_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2416
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\78c9d037b3bb874cc6d076f121ea811f_JaffaCakes118.dll,#1
  2⤵
  PID:1956

memory/1956-0-0x0000000000170000-0x000000000018C000-memory.dmp

Filesize
112KB

Download