9d8a8ea65af52e3f0515b9e19c3d249395c3be79f5c12cc9afa33ccc58cf4508

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
11/06/2024, 20:13

Target

9f662a6143a031ceb276e9c7f58c156b_JaffaCakes118.dll
Size

18KB
MD5

9f662a6143a031ceb276e9c7f58c156b
SHA1

76629131a956b85a89dcaab3a7e9b583742f6552
SHA256

9d8a8ea65af52e3f0515b9e19c3d249395c3be79f5c12cc9afa33ccc58cf4508
SHA512

0b85fc66802ab0dae6aaa9c5fb2309e5a6020c218343934f8b4bf0ae6cd4740d247ea5f1745efc51eb4a6ccbb7083932740190d279a677e471d2092405d8da09
SSDEEP

384:kxFgpSKBGwFHIUNiXZcYaf++9Gmn7PvcNB9f7vvxlLZWpEOKW:GgIOGCfNiX6lf++Rn73C7D2

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1280 wrote to memory of 3024	1280	rundll32.exe	28
PID 1280 wrote to memory of 3024	1280	rundll32.exe	28
PID 1280 wrote to memory of 3024	1280	rundll32.exe	28
PID 1280 wrote to memory of 3024	1280	rundll32.exe	28
PID 1280 wrote to memory of 3024	1280	rundll32.exe	28
PID 1280 wrote to memory of 3024	1280	rundll32.exe	28
PID 1280 wrote to memory of 3024	1280	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9f662a6143a031ceb276e9c7f58c156b_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1280
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9f662a6143a031ceb276e9c7f58c156b_JaffaCakes118.dll,#1
  2⤵
  PID:3024

memory/3024-1-0x000000001000B000-0x000000001000C000-memory.dmp

Filesize
4KB

Download
memory/3024-0-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download