8bc87086c770d0d22aa70689077b09578bd948878d9df5b4ad33024edfc87f5c

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
03/06/2024, 05:46

Target

90b8c3a5f27d562bec7114da9823bde5_JaffaCakes118.dll
Size

14KB
MD5

90b8c3a5f27d562bec7114da9823bde5
SHA1

449bcb9c620edc592d20865ee8ee2757f363f34d
SHA256

8bc87086c770d0d22aa70689077b09578bd948878d9df5b4ad33024edfc87f5c
SHA512

e5a3da136db07b7434bfaa7671b8496ef3d375245bb6716ef586ef6e97ff67023e9fa5c37295ef170f5793c2f84408a24913e166bfefef357b5ff8aaf8690ed3
SSDEEP

384:oeyxDuzzKmFGqBDKqTGBd4+xBPQ/e17f/85O2nblU2yOChYp:oesyqmFVeBBS6OK7f/+Uq6

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2880 wrote to memory of 2368	2880	rundll32.exe	28
PID 2880 wrote to memory of 2368	2880	rundll32.exe	28
PID 2880 wrote to memory of 2368	2880	rundll32.exe	28
PID 2880 wrote to memory of 2368	2880	rundll32.exe	28
PID 2880 wrote to memory of 2368	2880	rundll32.exe	28
PID 2880 wrote to memory of 2368	2880	rundll32.exe	28
PID 2880 wrote to memory of 2368	2880	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\90b8c3a5f27d562bec7114da9823bde5_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2880
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\90b8c3a5f27d562bec7114da9823bde5_JaffaCakes118.dll,#1
  2⤵
  PID:2368

memory/2368-1-0x000000001E1F0000-0x000000001E1FA000-memory.dmp

Filesize
40KB

Download
memory/2368-2-0x000000001E1F0000-0x000000001E1FA000-memory.dmp

Filesize
40KB

Download
memory/2368-3-0x000000001E1F0000-0x000000001E1FA000-memory.dmp

Filesize
40KB

Download
memory/2368-0-0x000000001E1F0000-0x000000001E1FA000-memory.dmp

Filesize
40KB

Download