c1a887d69fcb19483c1335ee94cdb9bcfd5343a9ece2ff8c910abda52667bc1e

Analysis

max time kernel
122s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
11/06/2024, 05:31

Target

9d21b84ec971c46e36e82ac67eb2ce8a_JaffaCakes118.dll
Size

790KB
MD5

9d21b84ec971c46e36e82ac67eb2ce8a
SHA1

96f8cae1c4587ca1e6ad1565e78a8958e834b91d
SHA256

c1a887d69fcb19483c1335ee94cdb9bcfd5343a9ece2ff8c910abda52667bc1e
SHA512

1b436c2abf5bf3479cb6dfffd5f11b074db915a65c1fea1acf1de2bc2ef4bd98aa2d7d26a49202ecede9aad440d863aae053c79a3df2ebd5521d33c170f37638
SSDEEP

24576:YH4WZb28o3xvu9xs/2cVqOh3+58W7kWBjy5s:YnZ6Jmi/VlEr

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2852 wrote to memory of 2868	2852	rundll32.exe	28
PID 2852 wrote to memory of 2868	2852	rundll32.exe	28
PID 2852 wrote to memory of 2868	2852	rundll32.exe	28
PID 2852 wrote to memory of 2868	2852	rundll32.exe	28
PID 2852 wrote to memory of 2868	2852	rundll32.exe	28
PID 2852 wrote to memory of 2868	2852	rundll32.exe	28
PID 2852 wrote to memory of 2868	2852	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9d21b84ec971c46e36e82ac67eb2ce8a_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2852
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9d21b84ec971c46e36e82ac67eb2ce8a_JaffaCakes118.dll,#1
  2⤵
  PID:2868

memory/2868-0-0x0000000074917000-0x0000000074A35000-memory.dmp

Filesize
1.1MB

Download
memory/2868-1-0x0000000074910000-0x0000000074AFC000-memory.dmp

Filesize
1.9MB

Download