532eb98db17de06e3306e43b26f3ee7b55fee89615e18b982a67a7812202da97

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
02-06-2024 18:18

Target

8ef9f46380b86bd05bbffd40750154e6_JaffaCakes118.dll
Size

34KB
MD5

8ef9f46380b86bd05bbffd40750154e6
SHA1

99062bfdea880521f721ad804121882b87fe1dcd
SHA256

532eb98db17de06e3306e43b26f3ee7b55fee89615e18b982a67a7812202da97
SHA512

0e0619bca4cc8984e38ae2fb404b949d7dcc7ed556fb6db8345ff41988cf3039accb097f2533ecfdcacc82ea61115d22297f356c08fd268acad1ff96a6ac31db
SSDEEP

768:EnzYdq2IZsu2A+g7yP/tDjYEeTnS9/7Y0dkMlUgCHrk7D:EkdzIpO0EeTnSZ7Y6kMl12

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2452 wrote to memory of 2172	2452	rundll32.exe	28
PID 2452 wrote to memory of 2172	2452	rundll32.exe	28
PID 2452 wrote to memory of 2172	2452	rundll32.exe	28
PID 2452 wrote to memory of 2172	2452	rundll32.exe	28
PID 2452 wrote to memory of 2172	2452	rundll32.exe	28
PID 2452 wrote to memory of 2172	2452	rundll32.exe	28
PID 2452 wrote to memory of 2172	2452	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8ef9f46380b86bd05bbffd40750154e6_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2452
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\8ef9f46380b86bd05bbffd40750154e6_JaffaCakes118.dll,#1
  2⤵
  PID:2172

memory/2172-0-0x000000006E790000-0x000000006E7A7000-memory.dmp

Filesize
92KB

Download
memory/2172-1-0x000000006E790000-0x000000006E7A7000-memory.dmp

Filesize
92KB

Download