c29f7be1aabdc2df8659fbdc31b4a350766a21e1a2bad859a3e161f845c45714

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
19-06-2024 23:58

Target

014f9f84f72c5457f2f9510c6e7331e8_JaffaCakes118.dll
Size

41KB
MD5

014f9f84f72c5457f2f9510c6e7331e8
SHA1

f4cb3c52ffd1957655897b570af463c8b3700386
SHA256

c29f7be1aabdc2df8659fbdc31b4a350766a21e1a2bad859a3e161f845c45714
SHA512

5dbd33a20dbbba7bcf026527b129dcc59571348b702bd476c9dcbe6bfe72a77888aab5dfbe39d0c375a366fb711725f27d678d9476280b930505f102f6cb5983
SSDEEP

768:79ASu+fPFFR+twkG2Ht7ZaWmldBbOMHnuqEXBcV5t6eDYYPdMHg8:6B+fPrQwp6tXUdBqMHnGuXt6epdMHg8

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2164 wrote to memory of 2384	2164	rundll32.exe	28
PID 2164 wrote to memory of 2384	2164	rundll32.exe	28
PID 2164 wrote to memory of 2384	2164	rundll32.exe	28
PID 2164 wrote to memory of 2384	2164	rundll32.exe	28
PID 2164 wrote to memory of 2384	2164	rundll32.exe	28
PID 2164 wrote to memory of 2384	2164	rundll32.exe	28
PID 2164 wrote to memory of 2384	2164	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\014f9f84f72c5457f2f9510c6e7331e8_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2164
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\014f9f84f72c5457f2f9510c6e7331e8_JaffaCakes118.dll,#1
  2⤵
  PID:2384

memory/2384-0-0x0000000010000000-0x000000001001B000-memory.dmp

Filesize
108KB

Download
memory/2384-1-0x000000001001A000-0x000000001001B000-memory.dmp

Filesize
4KB

Download