fd4d98d11f4ab42f1989abb90dd31a0c9202cd98b78131f792b5f7b7c966d1ed

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
19-06-2024 23:07

Target

010fe3770b17800bf83ab37454d91549_JaffaCakes118.dll
Size

2.2MB
MD5

010fe3770b17800bf83ab37454d91549
SHA1

b49359ca30923cb4483b16c9b6451874af193939
SHA256

fd4d98d11f4ab42f1989abb90dd31a0c9202cd98b78131f792b5f7b7c966d1ed
SHA512

e26830eb907a204592fedf8263acdae2a741738e8bbf377e9af813208f1f9b89b55972243a2e62049c66013b09b04d6ee073607321cc576f52ba29ba4ef45a37
SSDEEP

49152:+X59ZZaNeLut/MAyVOr6kcXMfKAfqNMP9Pyz6DMPCMTbzw:a59PaNe4/wsr6kcXv69PvQP1U

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1580 wrote to memory of 2788	1580	rundll32.exe	28
PID 1580 wrote to memory of 2788	1580	rundll32.exe	28
PID 1580 wrote to memory of 2788	1580	rundll32.exe	28
PID 1580 wrote to memory of 2788	1580	rundll32.exe	28
PID 1580 wrote to memory of 2788	1580	rundll32.exe	28
PID 1580 wrote to memory of 2788	1580	rundll32.exe	28
PID 1580 wrote to memory of 2788	1580	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\010fe3770b17800bf83ab37454d91549_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1580
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\010fe3770b17800bf83ab37454d91549_JaffaCakes118.dll,#1
  2⤵
  PID:2788

memory/2788-0-0x0000000010000000-0x0000000010009000-memory.dmp

Filesize
36KB

Download