74aeea6387a4fd60be2a0a12c1a61c4bdeefdc519e20328ac07e80beee3234a1

Analysis

max time kernel
120s
max time network
122s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
16/06/2024, 04:21

Target

b1b3258064f7e4fa135211210e5fffd5_JaffaCakes118.dll
Size

12KB
MD5

b1b3258064f7e4fa135211210e5fffd5
SHA1

81f80ff835907eb12ee9f53e75b91289b69e8279
SHA256

74aeea6387a4fd60be2a0a12c1a61c4bdeefdc519e20328ac07e80beee3234a1
SHA512

9331b1ccfe4696e5ae671ec9414e096311a6e1442a3f34eb97bbb36b8b363475c270fdd779eff944d81743b2d8fe71f1348303e2ce93a0bbeed3c3e8cf7826c9
SSDEEP

192:8PpZMlbVJyLcKUr8eQCljjJ597EzplpNBeNKxmp2gfyPj3sBCUYp:IPMlDyvABJ61lLBLxephcUYp

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2276 wrote to memory of 3068	2276	rundll32.exe	28
PID 2276 wrote to memory of 3068	2276	rundll32.exe	28
PID 2276 wrote to memory of 3068	2276	rundll32.exe	28
PID 2276 wrote to memory of 3068	2276	rundll32.exe	28
PID 2276 wrote to memory of 3068	2276	rundll32.exe	28
PID 2276 wrote to memory of 3068	2276	rundll32.exe	28
PID 2276 wrote to memory of 3068	2276	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b1b3258064f7e4fa135211210e5fffd5_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2276
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b1b3258064f7e4fa135211210e5fffd5_JaffaCakes118.dll,#1
  2⤵
  PID:3068

memory/3068-0-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/3068-1-0x000000001000D000-0x000000001000E000-memory.dmp

Filesize
4KB

Download