602b7433041c8fde2f984769a3cd5868a11beab1771c7ca23cabf63d9989a178

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
19-06-2024 19:24

Target

0022a47b6202798444c43079c9035adf_JaffaCakes118.dll
Size

7KB
MD5

0022a47b6202798444c43079c9035adf
SHA1

13ff1fe5693fc3f735a1d274a27d851007e958a2
SHA256

602b7433041c8fde2f984769a3cd5868a11beab1771c7ca23cabf63d9989a178
SHA512

7be2d6ba0352cb7d6eb314434902f933870a22e2d94343f96bbb1877bf72df943989770abea70e805868a29cfe067ab63db41f2a16c1f663bdb21c270f30987a
SSDEEP

192:niT+jmfgaCWWJPYGOwV11JxN3CBaWYJkgUwu9:iTh9CWWS8JH3CkGf

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2128 wrote to memory of 1816	2128	rundll32.exe	28
PID 2128 wrote to memory of 1816	2128	rundll32.exe	28
PID 2128 wrote to memory of 1816	2128	rundll32.exe	28
PID 2128 wrote to memory of 1816	2128	rundll32.exe	28
PID 2128 wrote to memory of 1816	2128	rundll32.exe	28
PID 2128 wrote to memory of 1816	2128	rundll32.exe	28
PID 2128 wrote to memory of 1816	2128	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0022a47b6202798444c43079c9035adf_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2128
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0022a47b6202798444c43079c9035adf_JaffaCakes118.dll,#1
  2⤵
  PID:1816

memory/1816-1-0x000000002500C000-0x000000002500D000-memory.dmp

Filesize
4KB

Download
memory/1816-0-0x0000000025000000-0x0000000025014000-memory.dmp

Filesize
80KB

Download